Understand What Information the MITRE ATT&CK Framework Provides CCFR Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security architect is designing a detection strategy and wants to use ATT&CK to ensure comprehensive coverage. They are considering whether to focus on tactics, techniques, or procedures. Which level of granularity provides the best balance between coverage and actionability?

   • AProcedures, because they are the most specific and accurate
   • BTactics, because they cover all possible techniques under a goal
   • CSub-techniques, because they are more detailed than techniques
   • DTechniques, because they are specific enough to be actionable and broad enough to cover variations
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization is adopting ATT&CK for its security operations. The team is debating how to structure their detection coverage. They want to ensure that they cover the most common adversary behaviors without overwhelming the team with too many alerts. Which approach best leverages ATT&CK to achieve this balance?

   • APrioritize coverage of techniques that are commonly used across multiple tactics and have high impact
   • BImplement detections for every sub-technique to ensure complete coverage
   • CUse procedures from threat reports to create detections for every observed tool
   • DFocus only on the tactics, ignoring techniques, to reduce complexity
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is mapping an incident and sees that the adversary used a technique that is too broad to describe the specific action. What should the analyst use to provide more detail?

   • AA procedure
   • BA different matrix
   • CA sub-technique
   • DA new tactic
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the MITRE ATT&CK framework, what do tactics represent?

   • AThe technical vulnerabilities that adversaries exploit to gain access
   • BThe specific tools and commands used by adversaries during an attack
   • CThe defensive controls that organizations implement to stop attacks
   • DThe intermediate objectives or 'why' of an adversary's actions during an attack
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the MITRE ATT&CK framework, how do sub-techniques relate to their parent techniques?

   • ASub-techniques are the same as procedures and are documented only in threat reports
   • BSub-techniques are independent of parent techniques and are listed separately in the matrix
   • CSub-techniques are defensive recommendations associated with a parent technique
   • DSub-techniques are more specific variations of a parent technique, providing additional detail on how it can be executed
   Reveal Solution Discussion Select an answer first