CompTIA CySA+ (CS0-003)Vulnerability ManagementHard
An incident responder documents an attack using the Diamond Model of Intrusion Analysis. In the report, they record the C2 domain name, the hosting provider's IP address, and the compromised relay server used to route traffic to the attacker. Which core feature (vertex) of the Diamond Model does this information populate?
- AVictim
- BCapability
- CAdversary
- DInfrastructure
Show answer & explanationAnswer & explanation
Correct answer: D. Infrastructure
The Diamond Model's Infrastructure vertex captures the physical or logical communication structures the adversary uses to deliver capabilities and maintain control, such as domains, IP addresses, and relay/proxy servers. Adversary refers to the threat actor, Capability to the tools/malware/techniques used, and Victim to the targeted organization or asset.
Why the other options are wrong
- A. Victim refers to the target organization or system, not the attacker's supporting infrastructure.
- B. Capability refers to the tools, malware, or techniques the adversary employs.
- C. Adversary refers to the threat actor or group responsible, not the servers used.
Diamond Model: Infrastructure
One of the four core Diamond Model features, representing the physical/logical communication resources (domains, IPs, servers) an adversary uses to deliver capabilities.
- Four core features: Adversary, Capability, Infrastructure, Victim
- Infrastructure includes C2 domains, IPs, and relay/proxy servers
- Connects Adversary to Victim in the intrusion event
Memory trick: An Adversary uses Capability over Infrastructure against a Victim — AC-IV, like a diamond's four points