D340 Cyber Defense and Countermeasures - Set 1 - Part 1

Correct Answer: An individual or group that carries out malicious activity against systems

A threat actor is the entity conducting malicious activity, ranging from opportunistic criminals to organized groups and state-sponsored operations.

Correct Answer: Substantially greater resources, patience, and strategic objectives

Nation-state actors have extensive resources and pursue strategic goals such as espionage over long periods, unlike criminals seeking rapid financial gain.

Correct Answer: Risk originating from someone with legitimate authorized access

Insider threats come from employees, contractors, or partners with legitimate access, whether acting maliciously or through negligence.

Correct Answer: Their activity uses legitimate credentials and often appears normal

Insiders already hold valid access, so their actions resemble normal work. Detection depends on behavioral baselines and monitoring for anomalous patterns.

Correct Answer: Attacks motivated by political or ideological objectives

Hacktivists conduct attacks to advance political or social causes, often through website defacement, data leaks, or denial of service.

Correct Answer: The sequential stages an attacker progresses through during an intrusion

The kill chain models intrusion stages from reconnaissance through actions on objectives, helping defenders identify opportunities to detect and disrupt at each stage.

Correct Answer: The attacker gathers information about the target's people and systems

Reconnaissance collects information such as employee names, technologies in use, and exposed services, informing how the attacker will gain initial access.

Correct Answer: Gathering information without directly interacting with target systems

Passive reconnaissance uses public sources such as social media, DNS records, and job postings, leaving no trace in the target's logs.

Correct Answer: Information collected from publicly available sources

OSINT gathers intelligence from public sources including websites, social media, and public records, used by both attackers and defenders.

Correct Answer: Such details help attackers target known weaknesses precisely

Publicly disclosed technology stacks, version numbers, and internal naming conventions let attackers select relevant exploits without probing.

Correct Answer: Coupling an exploit with a payload to create a deliverable attack tool

Weaponization combines an exploit with a malicious payload into a deliverable artifact, such as a document embedding an exploit.

Correct Answer: Transmitting the weaponized payload to the target

Delivery transmits the attack to the victim through channels such as phishing email, a compromised website, or removable media.

Correct Answer: Maintaining access across reboots and credential changes

Persistence mechanisms such as scheduled tasks, service installation, or registry modifications ensure the attacker retains access after reboots or remediation attempts.

Correct Answer: The channel an attacker uses to direct compromised systems

C2 is the communication channel between compromised hosts and attacker infrastructure, used to issue commands and retrieve data.

Correct Answer: It blends with legitimate traffic and is commonly permitted outbound

HTTPS to common ports is nearly always allowed outbound and is encrypted, so C2 disguised as web traffic evades simple filtering and inspection.

Correct Answer: Unauthorized transfer of data out of an organization

Exfiltration is the unauthorized removal of data from the environment, often the ultimate objective of an intrusion.

Correct Answer: Monitoring for anomalous outbound data volumes and destinations

Baselining normal outbound traffic and alerting on unusual volumes, timing, or destinations surfaces exfiltration that content inspection alone might miss.

Correct Answer: Systematically identifying potential threats and weaknesses in a system design

Threat modeling analyzes a system to identify what could go wrong, who might attack it, and which mitigations are needed, ideally before implementation.

Correct Answer: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege

STRIDE provides six threat categories that prompt systematic consideration of how a system component could be attacked.

Correct Answer: The sum of all points where an attacker could attempt to interact with a system

The attack surface comprises every exposed interface, service, account, and input path. Reducing it is a fundamental defensive strategy.