English
Menu

Cyber Attacks and Defense in Practice

Which of the following is an "initial access" method, by which an attacker first gets into an organization's network?

  1. AExploiting a vulnerability in a VPN appliance exposed to the internet to get into the internal network
  2. BExtracting the credentials of a logged-in administrator from the memory of an already compromised PC and using them for further attacks
  3. CDeleting the backups on an internal file server, then encrypting the files and demanding a ransom
Show answer and explanation

Answer: A. Exploiting a vulnerability in a VPN appliance exposed to the internet to get into the internal network

Initial access is the stage at which an attacker establishes a first foothold in the organization's environment from outside. Typical methods include exploiting vulnerabilities in VPN appliances, web servers and other systems exposed to the internet, using phishing emails to get malware run or credentials entered, and logging in to remote access with legitimate IDs and passwords leaked elsewhere. Surveys of ransomware damage published by Japan's National Police Agency also reported that, in the first half of the 2020s, intrusions via VPN appliances and remote desktop accounted for most cases. The basic controls are therefore keeping a list of the devices exposed externally, applying fixes promptly and using multi-factor authentication for remote access.

  • A. Correct. Exploiting vulnerabilities in externally exposed devices is a typical initial access method.
  • B. This is an action after the intrusion; in ATT&CK it falls under the credential access tactic.
  • C. This is the final stage of an intrusion, which increases the damage and hinders recovery. In ATT&CK it falls under the impact tactic.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. An examination of the records of traffic on an internal network found the following traffic. Which of them most strongly suggests that malware is communicating with an external command server (C2 server)?
  2. An attacker who exploited a vulnerability in a web application can now run commands with the same ordinary user privileges as the web server program. Which of the following is an example of the "privilege escalation" the attacker carries out next?
  3. Which of the following is the most appropriate control for making "lateral movement" difficult, that is, the spread of a compromise from one hijacked employee PC to other PCs and servers inside the company?
  4. The technique in which an intruder avoids using custom malware as far as possible and works with legitimate tools already present in the OS, such as PowerShell, WMI and the standard remote administration features, is called "living off the land". Which of the following is the most appropriate way of thinking about countermeasures to this technique?
  5. Which of the following correctly describes access control based on the idea of zero trust?

Comparisons in this topic