To detect advanced persistent threat actors, analysts must look for artifacts related to:

Question

Options

• AOnly the initial infection vector
• BBroad patterns of normal user behavior
• CDeep and complex interrelations of TTPs
• DGeneric signatures of common malware

• A
  24% (8)
• B
  6% (2)
• C
  59% (20)
• D
  12% (4)

Explanation

Advanced Persistent Threat (APT) actors are sophisticated, well-resourced adversaries who operate over long timeframes, deliberately avoiding detection by blending into normal environments and using custom or modified tools - meaning no single artifact or signature will expose them. Detecting them requires mapping the deep and complex interrelations of TTPs (Tactics, Techniques, and Procedures) across the MITRE ATT&CK framework, because APTs are identified by behavioral patterns across the kill chain, not by any one indicator.

Why the distractors fail:

• A is wrong because APTs frequently change or obscure their initial infection vector; focusing only there means missing all post-compromise activity (lateral movement, exfiltration, persistence).
• B is wrong because normal user behavior is the baseline, not the detection target - APTs specifically mimic normal behavior to evade detection.
• D is wrong because APTs typically use custom malware, living-off-the-land binaries (LOLBins), and zero-days that bypass generic signature-based detection entirely.

Memory tip: Think "APT = A Pattern of Tactics" - the word persistent is your clue that detection requires sustained, multi-layered TTP analysis over time, not a single-point signature match.

No community discussion yet for this question.