ITPEC FE Morning April 2022 Question 40

An attack with sophisticated techniques that goes undetected for months or years — "advanced" and "persistent" describe a long, hidden, targeted campaign.

An APT is usually run by a well-resourced group against a chosen organization. It is advanced because it uses custom malware, unknown vulnerabilities and tailored spear-phishing, and persistent because after the intrusion it stays hidden, spreads inside the network, keeps backdoors and extracts data over a long period, often for espionage.

Answer (b)

Why not others:

• •(a) — re-creating deleted files is a trick of one kind of malware; APT is defined by the attacker's long, targeted, covert campaign, not by a file behaviour.
• •(c) — malware in the BIOS is a place to hide code, a technique an APT might use, but not what the term means.
• •(d) — disabling all of a company's computers is a visible, destructive attack like a wiper, the opposite of the stealth an APT relies on.

Key rule: "Persistent" in APT refers to the campaign staying inside the target for a long time unnoticed, not to malware that is hard to delete.

Security · AI-written, may contain errors