1.3 Operationalize the MITRE ATT&CK Framework to Research Threat Models, TTPs and Threat Actors, and Pivot as Necessary and Convey to Non-Technical Audiences CCFH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which ATT&CK resource is specifically designed to help analysts understand the behaviors of a particular threat actor group?

   • AThe ATT&CK Groups page
   • BThe ATT&CK Navigator
   • CThe ATT&CK for Enterprise matrix
   • DThe ATT&CK Software page
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services company wants to proactively identify the most relevant threat models for its environment. The company has a mix of on-premises and cloud workloads, and it handles sensitive customer financial data. Which approach using MITRE ATT&CK is most appropriate?

   • AReview all techniques in the ATT&CK framework and implement mitigations for every one of them.
   • BResearch threat actors that are known to target the financial sector and map their techniques to the company's specific environment.
   • CUse the ATT&CK framework to create a generic threat model that applies to all industries.
   • DFocus only on cloud-specific techniques because the company has cloud workloads.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which statement correctly describes the relationship between techniques and sub-techniques in the MITRE ATT&CK framework?

   • ATechniques are only used for detection, while sub-techniques are used for threat intelligence
   • BSub-techniques provide a more detailed breakdown of how a technique can be performed
   • CTechniques and sub-techniques are independent and unrelated entries in the framework
   • DSub-techniques are more general categories that contain multiple techniques
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When profiling a threat actor using MITRE ATT&CK, which information is most directly provided by the ATT&CK Groups page?

   • AThe actor's motivation and political affiliations
   • BThe known techniques and software associated with the actor
   • CThe recommended remediation steps for the actor's attacks
   • DThe actor's estimated financial resources
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When explaining a technical finding to a non-technical executive, which approach is most effective?

   • AExplain the technical steps of the attack in chronological order
   • BProvide the full list of MITRE ATT&CK technique IDs and sub-technique details
   • CUse analogies and business impact language to describe the threat
   • DFocus on the specific commands and tools used by the adversary
   Reveal Solution Discussion Select an answer first