1.2 Utilize the MITRE ATT&CK Framework to Model Threat Actor Behaviors CCFH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How can a security team use MITRE ATT&CK mappings to improve their detection strategy?

   • ABy automatically generating detection rules for all techniques.
   • BBy identifying which techniques are not currently covered by existing detections, allowing the team to prioritize new detection development.
   • CBy providing a list of known malware hashes to block.
   • DBy replacing the need for threat intelligence and log analysis.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is investigating a sophisticated attack that involved both IT and OT environments. The attacker used a spear-phishing email to gain initial access to the IT network, then moved laterally to the OT network and manipulated a safety controller. The team needs to document the full attack chain. Which combination of matrices should they use?

   • AUse the Enterprise matrix for the IT portion and the ICS matrix for the OT portion
   • BUse the Mobile matrix for the IT portion and the ICS matrix for the OT portion
   • CUse only the ICS matrix for the entire attack
   • DUse only the Enterprise matrix for the entire attack
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A detection engineering team is building alerts for a known threat group that commonly uses scheduled tasks for persistence and PowerShell for execution. The team wants to ensure they have coverage for the entire attack chain. Which approach best utilizes ATT&CK to achieve this?

   • ACreate alerts for the specific techniques used by the group, such as T1053.005 and T1059.001
   • BCreate alerts for all techniques in the Persistence and Execution tactics
   • CFocus only on the Initial Access technique to prevent the attack
   • DUse the ATT&CK Navigator to visualize the group's techniques, but do not create alerts
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A threat hunter observes an adversary using PowerShell to download and execute a script from a remote server. According to MITRE ATT&CK, which tactic is the adversary most directly achieving?

   • ADefense Evasion
   • BPersistence
   • CExecution
   • DCommand and Control
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During incident response, how can MITRE ATT&CK be used to prioritize actions?

   • ABy automatically containing the threat without human intervention.
   • BBy mapping observed adversary behavior to techniques and focusing on the techniques that align with the highest-impact tactics.
   • CBy providing a step-by-step playbook for every possible attack.
   • DBy determining the exact attribution of the threat actor.
   Reveal Solution Discussion Select an answer first