312-50 Question 161
Single answer▪ APT ConceptsA financial services company discovers that a single employee workstation has been making low-volume, encrypted outbound connections to a cloud-hosted server every night for several months. The malware on the host survives reboots, uses stolen domain credentials for lateral movement, and periodically exfiltrates small archives to avoid bandwidth alerts. Which assessment best matches this activity to an Advanced Persistent Threat (APT) operation?
- A
It is most consistent with an APT because it shows long-term persistence, stealthy command-and-control, credential abuse, and staged data exfiltration.
- B
It is not an APT because any attack using encrypted outbound traffic is classified as normal malware rather than a targeted intrusion.
- C
It is not an APT because APTs only rely on zero-day exploits and do not use legitimate credentials for movement inside the network.
- D
It is most consistent with a denial-of-service campaign because the repeated nightly traffic indicates an attempt to overwhelm external infrastructure.
Show answer and explanation
Correct answer: A
Explanation
An APT is generally defined by three core ideas: advanced tradecraft, persistence over time, and a targeted objective such as espionage or data theft. In this scenario, the malware maintains long-term access, avoids detection through low-volume encrypted communications, leverages stolen domain credentials to expand access, and exfiltrates data in small batches. These behaviors align closely with established threat models described by organizations such as NIST and MITRE ATT&CK. Relevant ATT&CK concepts include persistence mechanisms, command and control over encrypted channels, valid accounts for lateral movement, and exfiltration over web or cloud services. From a CEH exam perspective, the key distinction is that APTs are not defined by a single tool or exploit type; they are defined by sustained, stealthy, goal-oriented operations that adapt over time to remain inside the victim environment.
- A. Correct.
Correct. The scenario contains several hallmark indicators of an APT: persistence over months, covert command-and-control behavior, use of valid stolen credentials for lateral movement, and low-and-slow exfiltration designed to evade detection. In CEH context, APTs are characterized by sustained, targeted access and stealth rather than noisy or opportunistic activity.
- B. Incorrect.
Incorrect. Encrypted outbound traffic by itself does not rule in or rule out an APT. Many legitimate services use encryption, and many modern threats, including APTs, use encryption specifically to hide command-and-control and exfiltration. The misconception is assuming encryption implies benign use or excludes targeted attacks.
- C. Incorrect.
Incorrect. APT actors do not depend exclusively on zero-day exploits. In practice, they often combine phishing, misconfigurations, known vulnerabilities, remote administration tools, and stolen credentials. Abuse of legitimate credentials is a common and realistic tactic because it helps blend attacker activity with normal operations.
- D. Incorrect.
Incorrect. Denial-of-service activity is intended to disrupt availability, typically by generating high-volume traffic or resource exhaustion. The scenario describes the opposite pattern: low-volume, stealthy traffic, persistence, credential theft, and data exfiltration. Those indicators align with espionage-style intrusion rather than service disruption.