What is the role of procedures in the MITRE ATT&CK framework?

Procedures are the vulnerabilities that adversaries exploit to execute a technique

Procedures are specific implementations of a technique, often documented with real-world examples

Procedures are the high-level objectives that adversaries aim to achieve

Procedures are the detection rules that security teams use to identify techniques

An incident responder is documenting an attack and needs to decide whether to record the adversary's action as a technique or a procedure. The action is 'used a modified version of Mimikatz to dump credentials'. What is the most appropriate classification?

Sub-technique, because it is a more detailed version of a technique

Tactic, because it achieves the goal of credential access

Technique, because it is a method used by the adversary

Procedure, because it is a specific implementation of a technique

A junior analyst asks why the team uses MITRE ATT&CK instead of a simple list of malware signatures. Which response best explains the advantage of ATT&CK?

ATT&CK is a real-time threat intelligence feed

ATT&CK provides a list of all known malware hashes

ATT&CK focuses on adversary behavior, not just indicators, allowing for detection of novel variations

ATT&CK is a vulnerability scanner

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 1Objective 1

Understand What Information the MITRE ATT&CK Framework Provides CCFR Practice Questions (Page 3)

Part of the ATT&CK Frameworks domain, which makes up ~10% of our current practice bank.

28questions here

6free pages

6concepts

Questions 11–15

11application · medium
An incident responder is writing a report and needs to describe the adversary's actions in a structured way. They want to include the goal, the method, and the specific tool used. Which ATT&CK elements should they use, respectively?
Select an answer first
12application · medium
A threat intelligence report states that a group used a specific open-source tool to perform credential dumping. In ATT&CK, how would this tool be classified?
Select an answer first
13foundation · easy
What is the role of procedures in the MITRE ATT&CK framework?
Select an answer first
14expert · hard
An incident responder is documenting an attack and needs to decide whether to record the adversary's action as a technique or a procedure. The action is 'used a modified version of Mimikatz to dump credentials'. What is the most appropriate classification?
Select an answer first
15application · medium
A junior analyst asks why the team uses MITRE ATT&CK instead of a simple list of malware signatures. Which response best explains the advantage of ATT&CK?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.

Understand What Information the MITRE ATT&CK Framework Provides CCFR Practice Questions (Page 3)

Questions 11–15

An incident responder is writing a report and needs to describe the adversary's actions in a structured way. They want to include the goal, the method, and the specific tool used. Which ATT&CK elements should they use, respectively?

A threat intelligence report states that a group used a specific open-source tool to perform credential dumping. In ATT&CK, how would this tool be classified?

What is the role of procedures in the MITRE ATT&CK framework?

An incident responder is documenting an attack and needs to decide whether to record the adversary's action as a technique or a procedure. The action is 'used a modified version of Mimikatz to dump credentials'. What is the most appropriate classification?

A junior analyst asks why the team uses MITRE ATT&CK instead of a simple list of malware signatures. Which response best explains the advantage of ATT&CK?

Keep studying — ATT&CK Frameworks