CA1-005: CompTIA SecurityXDemo

By CompTIA · Question Mode

QuestionQ115

Security Operations

After multiple companies in the financial industry experienced a similar incident, they shared threat-intelligence information and the malware used for exploitation. Which actions should the companies take to best determine whether the attacks are being carried out by the same actor?

Choose two
  • A Apply code stylometry.
  • B Look for common TTPs.
  • C Use IoC extractions.
  • D Leverage malware detonation.
  • E Perform malware decompilation.
  • F Verify malware hashes.
Explanation

Common TTPs provide a behavioral fingerprint that can link intrusions to a threat actor’s established tradecraft. Code stylometry compares implementation and programming-style characteristics that can associate malware with the same author or development group. Hashes and extracted indicators mainly correlate specific artifacts, whereas detonation and decompilation are techniques for examining malware rather than attribution criteria. MITRE ATT&CK catalogs adversary tactics and techniques from real-world observations and tracks threat groups as activity clusters.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!