Understand What Information the MITRE ATT&CK Framework Provides CCFR Practice Questions (Page 6)

Questions 26–28

1. 26foundation · easy

   Which of the following is a common tactic category in the MITRE ATT&CK framework?

   • APersistence
   • BPatch management
   • CVulnerability scanning
   • DLog aggregation
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team wants to evaluate their detection coverage against known adversary behavior. They have a list of techniques used by a specific threat group. How can MITRE ATT&CK help them identify gaps in their detection capabilities?

   • ABy providing a list of all possible techniques that could be used by any adversary
   • BBy ranking techniques based on the likelihood of being used by the threat group
   • CBy mapping their current detections to ATT&CK techniques and comparing against the threat group's techniques
   • DBy automatically deploying new detection rules for any missing techniques
   Reveal Solution Discussion Select an answer first
3. 28application · medium

   An analyst is reviewing ATT&CK documentation and sees that 'T1059.001' refers to 'PowerShell'. What does the '.001' suffix indicate?

   • AIt is a procedure used by a specific threat group
   • BIt is a sub-technique of the parent technique 'Command and Scripting Interpreter'
   • CIt is a version number of the technique
   • DIt is a tactic within the Execution category
   Reveal Solution Discussion Select an answer first