During a security review, a manager asks the incident response team to justify their use of MITRE ATT&CK. The team has been mapping observed adversary actions to ATT&CK techniques. Which statement best explains the primary value of using ATT&CK in this context?

It provides a standardized language to describe adversary behavior, enabling consistent communication and comparison across incidents.

It automatically generates detection rules for any technique once the technique is identified.

It replaces the need for threat intelligence by providing a complete list of all possible adversary actions.

It guarantees that all adversary techniques will be detected if the framework is followed.

How can the MITRE ATT&CK framework be used to improve detection capabilities in incident response?

By mapping observed adversary behavior to techniques, allowing teams to identify gaps in their detection coverage

By replacing the need for threat intelligence feeds during an incident

By providing a checklist of vulnerabilities to patch before an attack occurs

By automatically blocking all techniques listed in the framework

During an incident review, the team categorizes adversary actions into columns on the ATT&CK matrix. One column is labeled 'Persistence'. What does this column represent in the context of the framework?

The initial method used to gain access to the network

The techniques used to evade detection by security controls

The adversary's goal of maintaining access to the system across reboots or credential changes

The specific tools and commands used by the adversary to achieve their objectives

During an incident investigation, the team discovers that the adversary used a technique that is not yet documented in ATT&CK. What should the team do to ensure their findings are still useful?

Ignore the behavior, as it is not in ATT&CK

Document the behavior using the closest related technique and note the gap for future ATT&CK updates

Use a different framework that covers all possible behaviors

Create a new technique and add it to ATT&CK immediately

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 1Objective 1

Understand What Information the MITRE ATT&CK Framework Provides CCFR Practice Questions (Page 5)

Part of the ATT&CK Frameworks domain, which makes up ~10% of our current practice bank.

28questions here

6free pages

6concepts

Questions 21–25

21application · medium
During a security review, a manager asks the incident response team to justify their use of MITRE ATT&CK. The team has been mapping observed adversary actions to ATT&CK techniques. Which statement best explains the primary value of using ATT&CK in this context?
Select an answer first
22foundation · easy
How can the MITRE ATT&CK framework be used to improve detection capabilities in incident response?
Select an answer first
23application · medium
During an incident review, the team categorizes adversary actions into columns on the ATT&CK matrix. One column is labeled 'Persistence'. What does this column represent in the context of the framework?
Select an answer first
24application · medium
In the ATT&CK matrix, the columns represent tactics. Which of the following is a tactic, not a technique or procedure?
Select an answer first
25expert · hard
During an incident investigation, the team discovers that the adversary used a technique that is not yet documented in ATT&CK. What should the team do to ensure their findings are still useful?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.