350-201 Question 164
Select 3A cybersecurity analyst is investigating a recent data breach. During the analysis, they identify that the attacker used stolen credentials to access multiple systems and deployed ransomware that encrypted critical files. Which tactics, techniques, and procedures (TTPs) should the analyst prioritize in their investigation to understand the attack's progression?
- A
Credential Access and Lateral Movement
- B
Persistence and Privilege Escalation
- C
Exploitation of Public-Facing Applications
- D
Command and Control Communication
- E
Data Exfiltration
Show answer and explanation
Correct answers: A, B, D
Explanation
To determine the TTPs involved in the attack, the analyst should focus on behaviors like credential access, lateral movement, persistence, privilege escalation, and command and control communication. These steps are critical to understanding how the attacker gained access, maintained it, and executed their malicious actions. Data exfiltration and exploitation of public-facing applications were not part of the described scenario.
- A. Correct.
Credential Access and Lateral Movement are correct because the attacker used stolen credentials to access multiple systems, which indicates lateral movement across the network.
- B. Correct.
Persistence and Privilege Escalation are correct as attackers often establish persistence or escalate privileges to maintain access and execute further malicious actions like deploying ransomware.
- C. Incorrect.
Exploitation of Public-Facing Applications is incorrect because there is no evidence in this scenario that the attacker exploited a vulnerability in a public-facing application.
- D. Correct.
Command and Control Communication is correct because ransomware typically communicates with a command and control server to receive encryption keys or instructions.
- E. Incorrect.
Data Exfiltration is incorrect because the scenario does not mention any data being exfiltrated by the attacker.