Understand What Information the MITRE ATT&CK Framework Provides CCFR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During an incident post-mortem, the team wants to compare the adversary's behavior across two different incidents to see if they are related. How can ATT&CK facilitate this comparison?

   • ABy providing a list of indicators of compromise for each incident
   • BBy ranking the incidents based on severity
   • CBy using ATT&CK to automatically attribute the incidents to a threat group
   • DBy mapping both incidents to the same ATT&CK techniques and comparing the patterns
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is documenting an intrusion and notes that the adversary used PowerShell to download and execute a payload. In the ATT&CK matrix, which two elements would this activity be classified under?

   • ATactic: Execution; Technique: Command and Scripting Interpreter
   • BTactic: Persistence; Technique: Scheduled Task
   • CTactic: Defense Evasion; Technique: Obfuscated Files or Information
   • DTactic: Command and Control; Technique: Ingress Tool Transfer
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which statement best describes the source of information used to build the MITRE ATT&CK framework?

   • AIt is derived exclusively from theoretical attack models proposed by academic researchers
   • BIt is based on real-world observations of adversary behavior, including threat reports and incident analyses
   • CIt is compiled from hypothetical scenarios created by security vendors for product marketing
   • DIt is generated by automated penetration testing tools that simulate attacks in a lab environment
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is building detections for a specific threat group. They have access to threat reports that describe the group's use of a custom tool for credential dumping. The team wants to create a detection that is resilient to changes in the tool. Which approach is most aligned with ATT&CK?

   • ADetect the tactic (e.g., Credential Access) to cover all possible techniques
   • BDetect the underlying technique (e.g., OS Credential Dumping) rather than the specific tool
   • CDetect the specific tool's file hash to ensure accuracy
   • DDetect the procedure exactly as described in the threat report
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During an investigation, an analyst notes that a specific threat group used a custom PowerShell script to enumerate Active Directory. In ATT&CK terms, what is the custom PowerShell script considered?

   • AA sub-technique, because it is a more detailed version of a technique
   • BA procedure, because it is a specific implementation of a technique
   • CA tactic, because it achieves a specific goal
   • DA technique, because it is a method used by the adversary
   Reveal Solution Discussion Select an answer first