Understand What Information the MITRE ATT&CK Framework Provides CCFR Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How do procedures differ from techniques in the MITRE ATT&CK framework?

   • AProcedures are general categories, while techniques are specific examples
   • BProcedures are specific examples of how a technique is executed, while techniques are the general behavior category
   • CProcedures are defensive actions, while techniques are offensive actions
   • DProcedures are the same as tactics, while techniques are the same as sub-techniques
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   During an incident, the team identifies that the adversary used a technique that is listed under multiple tactics in ATT&CK. The team is unsure which tactic to assign in their incident report. What is the best practice for handling this situation?

   • AAssign all possible tactics to ensure completeness
   • BDo not assign a tactic, as the technique is ambiguous
   • CAssign the tactic that best matches the adversary's goal in this specific incident
   • DAssign the first tactic listed in the ATT&CK matrix
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the role of procedures within the structure of the MITRE ATT&CK framework?

   • AProcedures are the high-level categories that group related techniques together
   • BProcedures are specific implementations of a technique, often tied to a particular threat actor or tool
   • CProcedures are the detection rules that identify when a technique is being used
   • DProcedures are the defensive measures recommended to mitigate each technique
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of the MITRE ATT&CK framework?

   • ATo automate the patching of known software vulnerabilities across an enterprise environment
   • BTo replace traditional antivirus signatures with behavioral detection rules
   • CTo serve as a knowledge base of adversary tactics and techniques based on real-world observations
   • DTo provide a standardized scoring system for comparing the severity of different malware families
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a valid use case for the MITRE ATT&CK framework during incident response?

   • AReplacing the need for forensic analysis during an investigation
   • BAutomatically containing infected hosts without analyst intervention
   • CDetermining the monetary loss associated with a data breach
   • DMapping adversary behavior observed in an incident to specific techniques and tactics
   Reveal Solution Discussion Select an answer first