I85PREP
⌘ K
NCJOSI study materials
NCJOSI study resources

NCJOSI: Threat Landscape and Attack Vectors

NCJOSI · Work through your exam, one topic at a time.

All guide sections

Threat Landscape and Attack Vectors

Threat Landscape and Attack Vectors tests whether you can name the actor, the technique, and the observable evidence for a short scenario. Questions usually give a narrative and ask you to classify the activity, not to recall marketing names for malware families.

Core rules

  • Separate the four terms: threat (actor and intent), vulnerability (the weakness), exploit (the method used), risk (likelihood combined with impact).
  • Map behaviour to MITRE ATT&CK tactics in sequence: Reconnaissance, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.
  • Common delivery vectors: phishing and spear phishing, malicious attachments or links, drive-by compromise, valid accounts, supply-chain compromise, exposed services, removable media.
  • Web attacks: SQL injection (input concatenated into a query), XSS (untrusted script running in a victim browser), CSRF (state-changing request without an intent check), SSRF (server fetches an attacker-chosen URL).
  • Ransomware crews typically exfiltrate before encrypting, so intact backups alone are not sufficient; you also need detection of data staging and command-and-control traffic.
  • Volumetric DDoS saturates bandwidth; application-layer DDoS exhausts worker threads or queries and is invisible to packet-rate thresholds.

Worked example

A user opens an invoice attachment; a macro spawns powershell.exe -enc; the process writes a Run key, dumps LSASS memory, then authenticates over SMB to a file server using a newly created account. Classification: Initial Access (phishing attachment) then Execution (scripting interpreter) then Persistence (registry Run key, T1547.001) then Credential Access (LSASS memory, T1003.001) then Lateral Movement (SMB and admin shares). Four of those five steps produce host telemetry, so process-creation logging with command-line capture would have detected the chain before a perimeter signature did.

Traps that cost marks

  • Calling every unwanted email phishing, or using spear phishing and phishing interchangeably.
  • Confusing a vulnerability scan finding with evidence of an active compromise.
  • Assuming fileless or living-off-the-land activity leaves no artefacts; it leaves process, registry, and network artefacts.
  • Treating a single failed login as brute force when it may be a stale cached credential.