1.2 Utilize the MITRE ATT&CK Framework to Model Threat Actor Behaviors CCFH Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is reviewing an alert where an attacker used a legitimate system tool (e.g., PowerShell) to perform actions that are also commonly performed by administrators. The analyst needs to determine if this is malicious or benign. Which approach best uses ATT&CK to make this determination?

   • AIgnore the alert because the tool is legitimate
   • BCompare the specific technique used against the context of the user's normal behavior and the environment
   • CMap the technique to ATT&CK and immediately escalate to incident response
   • DAssume any use of PowerShell is malicious and block it
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In the MITRE ATT&CK enterprise matrix, what is the relationship between a technique and its sub-techniques?

   • ASub-techniques are techniques that are only used in the mobile matrix.
   • BSub-techniques are deprecated techniques that have been replaced by newer ones.
   • CSub-techniques are more specific variations of a technique, providing additional detail on how the technique can be performed.
   • DSub-techniques are alternative names for the same technique used by different threat actors.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An analyst sees an alert for a process creating a scheduled task on a Windows host. Which MITRE ATT&CK tactic is the adversary most likely pursuing?

   • ALateral Movement
   • BDiscovery
   • CExfiltration
   • DPersistence
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A threat hunting team is reviewing a series of alerts and wants to identify which techniques are not currently covered by their detection stack. They have mapped all observed behaviors to ATT&CK. Which approach best uses ATT&CK to identify coverage gaps?

   • AFocus on the techniques with the highest severity ratings in ATT&CK
   • BLook for techniques that are used by multiple threat actors
   • CCompare the mapped techniques against the list of techniques with existing detections
   • DReview the ATT&CK Navigator to see the full matrix and assume all techniques are covered
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst is documenting a threat actor's behavior: the actor used a legitimate Windows tool (PsExec) to execute commands remotely on multiple hosts. The analyst needs to classify this activity in ATT&CK. Which technique and tactic pair is most appropriate?

   • AT1059 Command and Scripting Interpreter, Execution
   • BT1021 Remote Services, Lateral Movement
   • CT1572 Protocol Tunneling, Command and Control
   • DT1047 Windows Management Instrument, Discovery
   Reveal Solution Discussion Select an answer first