1.3 Operationalize the MITRE ATT&CK Framework to Research Threat Models, TTPs and Threat Actors, and Pivot as Necessary and Convey to Non-Technical Audiences CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is investigating a series of intrusions at a manufacturing company. The analyst discovers that the attackers used a specific remote access tool and a technique for disabling security software. The analyst wants to determine if a known threat actor group is responsible. Which approach using MITRE ATT&CK is most effective?

   • AReview the ATT&CK framework for all techniques that involve remote access and create a list of potential actors.
   • BCheck the company's firewall logs to see if the attackers' IP addresses are listed in any public threat intelligence feeds.
   • CSearch ATT&CK for the tool and technique, then review the groups that are associated with both to identify a potential match.
   • DLook up the remote access tool in a general software database to see if it is commonly used by cybercriminals.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which ATT&CK resource would you use to find a list of software (tools and malware) associated with a specific threat actor group?

   • AThe ATT&CK Mitigations page
   • BThe ATT&CK Navigator
   • CThe ATT&CK Groups page
   • DThe ATT&CK Matrix
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which ATT&CK tactic is associated with the technique 'Exfiltration Over C2 Channel' (T1041)?

   • ACollection
   • BCommand and Control
   • CImpact
   • DExfiltration
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A security analyst observes a process creating a scheduled task on a Windows host. According to MITRE ATT&CK, what is the most appropriate technique ID for this behavior?

   • AT1059.001 – PowerShell
   • BT1547.001 – Registry Run Keys / Startup Folder
   • CT1053.005 – Scheduled Task
   • DT1486 – Data Encrypted for Impact
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A regional bank has been notified by a partner that a phishing email was sent to several employees, but the email was blocked before delivery. The bank's security team wants to proactively assess whether the phishing campaign could have led to a significant breach if the email had been delivered. They need to understand the likely end-to-end impact of the campaign. Which approach best aligns with using the MITRE ATT&CK framework to meet this need?

   • AMap the phishing email to the Initial Access tactic and then trace the techniques the adversary would likely use to achieve their objectives, such as credential access and lateral movement.
   • BReview the bank's security policies to see if phishing emails are typically blocked, and if so, conclude that no further analysis is needed.
   • CSearch the ATT&CK framework for all techniques that involve email as a delivery method and list them in a report for the board.
   • DIdentify the specific malware family used in the phishing email and look up its known techniques in ATT&CK to determine if it is dangerous.
   Reveal Solution Discussion Select an answer first