Exam CAS-004 topic 1 question 14 discussion

C. An advanced persistent threat. This question doesn't describe a DROWN, Zero-Day or on-path attack. The malicious actor was persistent over time (three months) and exfiltrated the data it needed. Then stopped once its objective was met.

APT fits the description

answer is C) an advanced persistent threat (APT). ✅ Explanation: An Advanced Persistent Threat (APT) is a prolonged and stealthy cyberattack where an attacker gains unauthorized access to a network and remains undetected for an extended period. In this case: Files were transferred over months, suggesting a persistent and stealthy exfiltration of data. The attacker used TLS-protected HTTP sessions, meaning they likely took steps to hide their activity and avoid detection. The activity stopped suddenly, which is characteristic of an APT either completing its objective or switching tactics to avoid detection. APTs are sneaky and patient, often operating undetected for months or even years. They carefully extract data while avoiding detection, making them one of the most dangerous cyber threats.

APT Source: Verifying each answer against Chat GPT, my experience, other test banks, a written book, and weighing in the discussion from all users to create a 100% accurate guide for myself before I take the exam. (It isn't easy because of the time needed, but it is doing my diligence)

The threat described, where a large number of files were transferred to remote sites via TLS-protected HTTP sessions from systems that do not usually send traffic to those sites, is commonly indicative of: C. An advanced persistent threat (APT).

The key characteristics of an APT that align with the scenario described are: Prolonged activity: The large number of files were transferred over three months. Stealthy operation: The activity was detected after the fact, indicating the attackers were able to operate without immediate detection. Unexpected sources: The systems involved in the transfer do not typically send traffic to those remote sites, indicating unusual and targeted behavi

The malicious actor was persistent over time (three months) and exfiltrated the data it needed. Then stopped once the objective was met.

C. I might lean towards A if it said SSL, but TLS is the successor to SSL...

C - Advance Persistent Threat

I agree with CKRET's analysis. C seems to be correct.