350-201 Question 162
Single answerA security analyst is investigating a recent cyberattack on their organization's network. During the investigation, they discover that the attacker established persistence by creating a new user account with administrative privileges and laterally moved through the network using stolen credentials. Which set of Tactics, Techniques, and Procedures (TTPs) does this describe?
- A
Persistence and Lateral Movement
- B
Execution and Exfiltration
- C
Discovery and Defense Evasion
- D
Privilege Escalation and Initial Access
Show answer and explanation
Correct answer: A
Explanation
The described scenario aligns with 'Persistence' and 'Lateral Movement' TTPs as the attacker created a new user account to maintain access (Persistence) and used stolen credentials to move laterally across the network (Lateral Movement). Understanding TTPs is crucial in identifying and mitigating attack patterns during investigations.
- A. Correct.
Persistence refers to the technique of maintaining access to a system even after a reboot or credential change, while Lateral Movement describes the attacker's action of spreading across the network to other systems using stolen credentials. These match the described scenario.
- B. Incorrect.
Execution involves running malicious code, and Exfiltration involves stealing data from the network. While related to attacks, these do not align with the specific TTPs described in the scenario.
- C. Incorrect.
Discovery involves identifying targets within the network, and Defense Evasion refers to avoiding detection by security tools. Neither directly corresponds to the creation of a new user account or lateral movement.
- D. Incorrect.
Privilege Escalation involves gaining higher privileges on a system, and Initial Access refers to the first compromise of a system. These do not fully capture the TTPs described in the scenario.