SANS FOR578 Book 2 EXAM 2025
LATEST EXAM QUESTIONS AND
CORRECT DETAILED ANSWERS WITH
RATIONALES NEW UPDATE!!!
Kill chain (CTI) - Answer - ✔✔ - established in 2011
- determanistic process
- seven stages to defend
Kill chain 7 sreps - Answer - ✔✔ 1. Reconnaissance and precursors
2. Weaponization
3. Delivery
4. Exploitation
5. Installation
6. C2
7. Action on objectives
Stage 1 - recon / precursors - Answer - ✔✔ - tasking - receipt or generation of
objectives
- acquisition of various tool
- acquisition of infrastructure
- identification of targets
- organizational research
Stage 2 - weaponization - Answer - ✔✔ - configuring {backdrops, droppers}
- packaging {container, exploit, first stage binary, decoy}
Stage 3 - delivrey - Answer - ✔✔ - mechanism = payload gets to target
- common vectors {protocol =SMTP,HTTP} or {media = USB, CD, DVD}
Stage 4 - exploitation - Answer - ✔✔ - disposition of the exploit {human or technical}
- affected application
- exploitation method
- characteristics of exploit shellcode
Stage 5 - installation - Answer - ✔✔ - associated with persistence
- properties of installation {filenames,directories, reg keys, reg values, communication}
- droppers
Stage 6 - C2 command and control - Answer - ✔✔ - establishing communication
, - properties of C2 {Trojan family, MD5, carrier protocol, embedded protocol,
infrastructure, operating mode characteristics}
Stage 7 - action on objectives - Answer - ✔✔ - commands executed
- additional tools transferred to VI machine
- files extracted
- files modified
Diamond Model - Answer - ✔✔ - made of 4 parts
- {adversary, capability, infrastructure,victim}
- has 7 AXIOMS
AXIOM 1 - Diamond model - Answer - ✔✔ In every intrusion event an adversary takes a
step towards an intended goal by using capability over infrastructure against a victim to
produce a result
AXIOM 2 - diamond model - Answer - ✔✔ There exist a set of adversaries which seek
to compromise computer systems or networks to further their intent and satisfy their
needs
AXIOM 3 - diamond model - Answer - ✔✔ Every system and by extension every victim
asset, has vulnerabilities and exposure
AXIOM 4 - diamond model - Answer - ✔✔ Every malicious activity contains two or more
phases which must be successfully executed in succession to achieve the desired result
AXIOM 5 - diamond model - Answer - ✔✔ Every intrusion event requires one or more
external resources to be satisfied prior to success
AXIOM 6 - diamond model - Answer - ✔✔ A relation always exists between the
adversary and their victims even if distant, fleeting, or indirect
AXIOM 7 - diamond model - Answer - ✔✔ There exist a subset of the set of adversaries
which have the motivation, resources, and capabilities to sustain malicious effects fro a
significant length of time against one or more victims resisting mitigation efforts
The 7 D's of Action - Answer - ✔✔ - discover
- detect
- deny
- disrupt
- degrade
- deceive
- destroy
LATEST EXAM QUESTIONS AND
CORRECT DETAILED ANSWERS WITH
RATIONALES NEW UPDATE!!!
Kill chain (CTI) - Answer - ✔✔ - established in 2011
- determanistic process
- seven stages to defend
Kill chain 7 sreps - Answer - ✔✔ 1. Reconnaissance and precursors
2. Weaponization
3. Delivery
4. Exploitation
5. Installation
6. C2
7. Action on objectives
Stage 1 - recon / precursors - Answer - ✔✔ - tasking - receipt or generation of
objectives
- acquisition of various tool
- acquisition of infrastructure
- identification of targets
- organizational research
Stage 2 - weaponization - Answer - ✔✔ - configuring {backdrops, droppers}
- packaging {container, exploit, first stage binary, decoy}
Stage 3 - delivrey - Answer - ✔✔ - mechanism = payload gets to target
- common vectors {protocol =SMTP,HTTP} or {media = USB, CD, DVD}
Stage 4 - exploitation - Answer - ✔✔ - disposition of the exploit {human or technical}
- affected application
- exploitation method
- characteristics of exploit shellcode
Stage 5 - installation - Answer - ✔✔ - associated with persistence
- properties of installation {filenames,directories, reg keys, reg values, communication}
- droppers
Stage 6 - C2 command and control - Answer - ✔✔ - establishing communication
, - properties of C2 {Trojan family, MD5, carrier protocol, embedded protocol,
infrastructure, operating mode characteristics}
Stage 7 - action on objectives - Answer - ✔✔ - commands executed
- additional tools transferred to VI machine
- files extracted
- files modified
Diamond Model - Answer - ✔✔ - made of 4 parts
- {adversary, capability, infrastructure,victim}
- has 7 AXIOMS
AXIOM 1 - Diamond model - Answer - ✔✔ In every intrusion event an adversary takes a
step towards an intended goal by using capability over infrastructure against a victim to
produce a result
AXIOM 2 - diamond model - Answer - ✔✔ There exist a set of adversaries which seek
to compromise computer systems or networks to further their intent and satisfy their
needs
AXIOM 3 - diamond model - Answer - ✔✔ Every system and by extension every victim
asset, has vulnerabilities and exposure
AXIOM 4 - diamond model - Answer - ✔✔ Every malicious activity contains two or more
phases which must be successfully executed in succession to achieve the desired result
AXIOM 5 - diamond model - Answer - ✔✔ Every intrusion event requires one or more
external resources to be satisfied prior to success
AXIOM 6 - diamond model - Answer - ✔✔ A relation always exists between the
adversary and their victims even if distant, fleeting, or indirect
AXIOM 7 - diamond model - Answer - ✔✔ There exist a subset of the set of adversaries
which have the motivation, resources, and capabilities to sustain malicious effects fro a
significant length of time against one or more victims resisting mitigation efforts
The 7 D's of Action - Answer - ✔✔ - discover
- detect
- deny
- disrupt
- degrade
- deceive
- destroy
