A threat hunting team has limited resources and must prioritize which ATT&CK techniques to build detections for. They have identified three techniques used by a high-profile threat group: T1059 (Command and Scripting Interpreter), T1053 (Scheduled Task), and T1567 (Exfiltration Over Web Service). The team's goal is to detect the attack as early as possible. Which technique should they prioritize?

T1567 Exfiltration Over Web Service

T1059 Command and Scripting Interpreter

All three should be prioritized equally

A security team is analyzing an attack that targeted both a corporate network and a mobile device used by an executive. The attacker used a phishing link to compromise the mobile device and then used the device to access corporate resources. The team needs to document the full attack chain. Which combination of matrices should they use?

Use the ICS matrix for the mobile device and the Enterprise matrix for the corporate network

Use only the Mobile matrix for the entire attack

Use the Mobile matrix for the mobile device compromise and the Enterprise matrix for the corporate network access

Use only the Enterprise matrix for the entire attack

A security team is investigating an attack on a manufacturing plant where the attacker manipulated the safety systems of an industrial robot. The team needs to map this to the appropriate ATT&CK matrix. Which matrix and tactic should they use?

ICS matrix, Inhibit Response Function

During an incident response engagement, an analyst observes that a threat actor used PowerShell to download a script from a remote server, then executed the script to enumerate domain admin groups. The analyst needs to map these activities to the MITRE ATT&CK framework to inform detection engineering. Which pair of tactics best represents the observed behaviors?

Defense Evasion and Credential Access

Command and Control and Exfiltration

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 1Objective 2

1.2 Utilize the MITRE ATT&CK Framework to Model Threat Actor Behaviors CCFH Practice Questions (Page 5)

Part of the ATT&CK Frameworks domain, which makes up ~10% of our current practice bank.

25questions here

5free pages

4concepts

Questions 21–25

21expert · hard
A threat hunting team has limited resources and must prioritize which ATT&CK techniques to build detections for. They have identified three techniques used by a high-profile threat group: T1059 (Command and Scripting Interpreter), T1053 (Scheduled Task), and T1567 (Exfiltration Over Web Service). The team's goal is to detect the attack as early as possible. Which technique should they prioritize?
Select an answer first
22expert · hard
A security team is analyzing an attack that targeted both a corporate network and a mobile device used by an executive. The attacker used a phishing link to compromise the mobile device and then used the device to access corporate resources. The team needs to document the full attack chain. Which combination of matrices should they use?
Select an answer first
23application · medium
A security team is investigating an attack on a manufacturing plant where the attacker manipulated the safety systems of an industrial robot. The team needs to map this to the appropriate ATT&CK matrix. Which matrix and tactic should they use?
Select an answer first
24application · medium
During an incident response engagement, an analyst observes that a threat actor used PowerShell to download a script from a remote server, then executed the script to enumerate domain admin groups. The analyst needs to map these activities to the MITRE ATT&CK framework to inform detection engineering. Which pair of tactics best represents the observed behaviors?
Select an answer first
25foundation · easy
A security analyst is investigating an attack against a programmable logic controller (PLC) in a manufacturing plant. Which MITRE ATT&CK matrix should the analyst consult to find relevant techniques?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

1.2 Utilize the MITRE ATT&CK Framework to Model Threat Actor Behaviors CCFH Practice Questions (Page 5)

Questions 21–25

A security team is investigating an attack on a manufacturing plant where the attacker manipulated the safety systems of an industrial robot. The team needs to map this to the appropriate ATT&CK matrix. Which matrix and tactic should they use?

A security analyst is investigating an attack against a programmable logic controller (PLC) in a manufacturing plant. Which MITRE ATT&CK matrix should the analyst consult to find relevant techniques?

Keep studying — ATT&CK Frameworks