200-201 · Question #32
Which two elements are assets in the role of attribution in an investigation? (Choose two.)
The correct answer is A. context E. threat actor. In an investigation, context and threat actor information are crucial assets for attributing an attack, providing the necessary understanding of who and why.
Question
Which two elements are assets in the role of attribution in an investigation? (Choose two.)
Options
- Acontext
- Bsession
- Claptop
- Dfirewall logs
- Ethreat actor
How the community answered
(59 responses)- A75% (44)
- B15% (9)
- C7% (4)
- D3% (2)
Why each option
In an investigation, context and threat actor information are crucial assets for attributing an attack, providing the necessary understanding of who and why.
Context provides the surrounding circumstances and background information necessary to understand the motivation, methods, and potential identity of the attacker.
A session refers to an active connection or interaction, which is a piece of evidence, not an asset used for attribution in the broader sense.
A laptop is a device that can be compromised or used in an attack, making it a source of evidence, not an overarching asset for attribution.
Firewall logs are sources of forensic data that provide indicators of compromise, but they are raw data rather than an analytical asset in the same way context or actor profiles are.
The threat actor refers to the individual or group responsible for an attack, and identifying them is the ultimate goal of attribution.
Concept tested: Cyber Threat Intelligence - Attribution Elements
Source: https://www.cisa.gov/resources-tools/resources/cyber-threat-intelligence
Topics
Community Discussion
No community discussion yet for this question.