1.3 Operationalize the MITRE ATT&CK Framework to Research Threat Models, TTPs and Threat Actors, and Pivot as Necessary and Convey to Non-Technical Audiences CCFH Practice Questions (Page 4)

Questions 16–19

1. 16application · medium

   A security analyst has completed a threat model for a healthcare organization, identifying that a specific ransomware group uses techniques such as 'Scheduled Task/Job' for persistence and 'Data Encrypted for Impact' for impact. The analyst must present these findings to the hospital's board of directors, who are not technical. Which presentation approach is most effective?

   • ARecommend that the board approve a budget for new security tools without explaining the specific threats.
   • BShow the ATT&CK technique IDs (e.g., T1053, T1486) and explain that these are well-known techniques used by the group.
   • CExplain that the ransomware group uses automated tasks to stay in the network and encrypts files to demand payment, using simple analogies.
   • DProvide a detailed list of all the commands and scripts the group uses, along with the technical names of the tools.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which statement best exemplifies translating a technical finding into non-technical language?

   • AThe adversary used T1053.005 to maintain persistence on the host.
   • BThe intrusion set leveraged a spearphishing attachment to deliver a remote access trojan.
   • CThe malware executed a PowerShell script to download a second-stage payload.
   • DThe attacker created a scheduled task to ensure they can regain access to the system later.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When researching threat models for an organization using MITRE ATT&CK, which factor is most important to consider first?

   • AThe organization's industry and the adversaries known to target that sector
   • BThe cost of implementing ATT&CK-based detections
   • CThe specific version of the ATT&CK framework to use
   • DThe number of techniques available in the framework
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst has identified that a threat actor is using a technique called 'Valid Accounts' to access the network. The analyst needs to explain this to a non-technical manager who is concerned about the risk. Which explanation is most effective?

   • ARecommend that the company immediately disable all user accounts to prevent the attacker from accessing the network.
   • BSay that the attacker is using a valid account, which is a common technique, and that the company should be more careful with passwords.
   • CExplain that the attacker is using legitimate user credentials to log in, which makes it harder to detect, and recommend monitoring for unusual account activity.
   • DState that the attacker is using a technique called 'Valid Accounts' and provide the ATT&CK ID T1078.
   Reveal Solution Discussion Select an answer first