CompTIA CySA+ (CS0-003)Vulnerability ManagementHard
An incident responder is using the Diamond Model of Intrusion Analysis to document an attack. The team identifies the malicious IP address 203.0.113.55 that hosted the phishing page and later received stolen credentials. Within the Diamond Model, which core feature does this IP address represent?
- ACapability
- BInfrastructure
- CVictim
- DAdversary
Show answer & explanationAnswer & explanation
Correct answer: B. Infrastructure
In the Diamond Model, Infrastructure refers to the physical or logical resources the adversary uses to deliver a capability or maintain communication, such as IP addresses, domains, and servers — exactly what the phishing-hosting IP represents.
Why the other options are wrong
- A. Capability refers to the tools, malware, or techniques used, such as the phishing kit itself.
- C. Victim refers to the target organization or individual being attacked, not attacker-controlled resources.
- D. Adversary refers to the threat actor or group behind the attack, not their hosting IP.
Diamond Model of Intrusion Analysis
An analytic framework describing an intrusion event through four core features: Adversary, Capability, Infrastructure, and Victim.
- Adversary = the threat actor/group
- Capability = tools, malware, exploits used
- Infrastructure = IPs, domains, servers used by attacker
- Victim = targeted person, system, or organization
Memory trick: A-C-I-V: Adversary Casts Infrastructure at Victim.