01
True or false
1 point
True or false: Every intrusion must follow the same fixed sequence of tactics and techniques.
Free Practice Quiz Question List
3 Attacks and Adversary Techniques Online Quiz Questions
Use this free practice quiz with 20 questions to review 3 Attacks and Adversary Techniques, test your knowledge, and prepare for your next test or exam.
20 questions
02
Choose one
1 point
A service becomes unavailable after receiving more requests than it can handle. Which attack type best fits this situation?
- A
Credential attack
- B
Denial-of-service attack
- C
Supply-chain compromise
- D
Insider misuse
03
Written response
1 point
What term describes a method or code that takes advantage of a vulnerability?
04
Fill in the blank
1 point
A weakness that could be used to harm a system is a .
05
True or false
1 point
True or false: A single indicator of compromise is always proof that an intrusion occurred.
- A
True
- B
False
06
Written response
1 point
What is the name of CISA's catalog that identifies vulnerabilities known to have been exploited?
07
Choose one
1 point
An attacker compromises a software supplier's update process to reach organizations that use the supplier's product. Which attack type best describes this route?
- A
An attacker overwhelms a public website with requests.
- B
An employee accidentally shares a file with the wrong recipient.
- C
An attacker abuses a software supplier's update to reach customer organizations.
- D
An attacker guesses a user's password using commonly reused passwords.
08
Fill in the blank
1 point
In MITRE ATT&CK, the goal of an adversary action is a , and how the actor pursues that goal is a .
09
Choose one
1 point
An attacker uses a widely available tool to scan many exposed systems without selecting each victim individually. Which broad threat-actor category best fits this behavior?
- A
Opportunistic attacker
- B
Hacktivist
- C
Insider
- D
Nation-state group
10
Choose all
1 point
An organization wants to reduce the chance that phishing or reused passwords will lead to account takeover. Which measures support that goal? Select all that apply.
- A
Use unique passwords for accounts.
- B
Keep an encrypted backup connected to the network at all times.
- C
Use phishing-resistant multifactor authentication where available.
- D
Give all users administrative privileges so they can resolve access problems.
11
Choose one
1 point
A company is planning for ransomware that could encrypt production systems and accessible backup files. Which measure best supports recovery?
- A
Maintain offline, encrypted backups and regularly test restoration.
- B
Keep all backups online and connected so they can be accessed quickly.
- C
Rely on the assumption that ransomware will not affect backup files.
- D
Replace backups with a policy of changing passwords regularly.
12
Choose all
1 point
A workstation has been compromised. Which controls can help limit an attacker's movement to other systems? Select all that apply.
- A
Segment networks and restrict unnecessary connections.
- B
Allow unrestricted connections between all network segments.
- C
Limit administrative privileges and remove access that is no longer needed.
- D
Disable security logs to reduce noise during an incident.
13
Choose one
1 point
A team can remediate only one system immediately. Which system should it prioritize based on the material's risk factors?
- A
A low-impact system with an unexposed weakness and no known exploit, regardless of other factors.
- B
An internet-facing, business-critical system with a vulnerability known to be actively exploited.
- C
A system that has already been isolated and has no business importance, solely because its software is old.
- D
Any vulnerability chosen at random, without considering exposure or impact.
14
Open ended
1 point
An employee reports a convincing fake document-sharing email. Identity logs show an unfamiliar-device sign-in, followed by shared-file access and an unusual download. What should responders do next? Give a concise, ordered response that addresses containment, investigation, evidence, and recovery.
15
Choose one
1 point
Which observation may be a warning sign of a credential attack?
- A
Unusual sign-ins or repeated failed logins
- B
An unpatched internet-facing system
- C
Files changing rapidly across many systems
- D
An unexpected new administrator account
16
Choose one
1 point
An employee receives a convincing message tailored to their role and organization, designed to make them open a harmful link. Which technique best describes this attack?
- A
Opportunistic scanning
- B
Insider misuse
- C
Targeted phishing
- D
Denial of service
17
Written response
1 point
What is the term for a technical artifact or observable that suggests an attack may be underway or may already have occurred?
18
Choose one
1 point
A security team finds an unpatched software flaw and a script that uses the flaw to gain access. Which statement correctly distinguishes the two?
- A
The unpatched flaw is a vulnerability; the code that takes advantage of it is an exploit.
- B
The unpatched flaw is an exploit; the code that takes advantage of it is a vulnerability.
- C
Both the flaw and the code are indicators of compromise.
- D
Neither is a vulnerability or exploit unless the system has already been compromised.
19
True or false
1 point
True or false: The presence of a vulnerability guarantees that a system will be compromised.
- A
True
- B
False
20
Written response
1 point
What term describes malicious software that may encrypt data for extortion?