1.3 Operationalize the MITRE ATT&CK Framework to Research Threat Models, TTPs and Threat Actors, and Pivot as Necessary and Convey to Non-Technical Audiences CCFH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   While researching a technique, an analyst notices that a specific threat actor group is associated with it. What is the most direct way to pivot from the technique to learn more about that actor?

   • AClick on the group's name in the technique's 'Groups' section to view the group's profile
   • BSearch the ATT&CK Software page for the group's name
   • CSearch the ATT&CK Mitigations page for the group's name
   • DSearch the ATT&CK Navigator for the group's name
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is profiling a threat actor that has been observed using a specific dropper and a technique for privilege escalation. The team wants to understand the actor's full capability set to prepare defenses. Which action using ATT&CK is most effective?

   • AMap the privilege escalation technique to a mitigation and implement it.
   • BCreate a list of all techniques in the 'Privilege Escalation' tactic and assume the actor uses all of them.
   • CReview the actor's page in ATT&CK to see all techniques and software associated with the group.
   • DSearch the internet for the dropper's name to find articles about the actor.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A government contractor is required to assess its security posture against known threat actors that target the defense industrial base. The contractor wants to use MITRE ATT&CK to create a threat model. Which approach is most aligned with this requirement?

   • ACreate a threat model based on the contractor's own past incidents only.
   • BUse the ATT&CK framework to list all techniques and implement mitigations for all of them.
   • CFocus on techniques that are commonly used by all threat actors, regardless of industry.
   • DIdentify threat actors that are known to target the defense industrial base and map their techniques to the contractor's environment.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A Falcon Hunter is investigating a series of alerts that show an adversary using a technique for lateral movement. The hunter also notices that the adversary is using a specific tool that is not commonly associated with the technique. The hunter wants to determine if the tool is a custom variant or a known tool. Which approach using ATT&CK is most effective?

   • ASearch the ATT&CK framework for all techniques that use the same tool and assume it is a known tool.
   • BReview the threat actor's profile to see if the tool is listed, and if not, conclude it is a custom variant.
   • CFocus on the lateral movement technique and implement mitigations to prevent further activity.
   • DPivot from the technique to the software that is known to use it, and compare the observed tool's behavior to known software.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In the MITRE ATT&CK framework, what is the primary purpose of a 'tactic'?

   • ATo describe the specific tool or command an adversary uses
   • BTo list the defensive controls that can detect a specific action
   • CTo categorize the adversary's short-term goal or objective during an attack
   • DTo provide a unique identifier for a specific piece of malware
   Reveal Solution Discussion Select an answer first