MITRE ATT&CK Framework CEH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A security team wants to create a visual representation of which ATT&CK techniques are covered by their endpoint detection and response (EDR) solution. Which feature of the ATT&CK Navigator would they use?

   • ACreating a layer that highlights covered techniques and exporting it as a heatmap
   • BAutomatically updating the EDR configuration to cover missing techniques
   • CRunning a live scan of the EDR logs to identify active threats
   • DGenerating a list of recommended EDR rules based on the techniques
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is reviewing a threat intelligence report about a campaign targeting financial institutions. The report describes the adversary using spear-phishing emails with malicious Excel macros, then PowerShell scripts to download Cobalt Strike, and finally scheduled tasks for persistence. The analyst wants to map these behaviors to the ATT&CK framework to identify the adversary. Which approach best aligns the report with ATT&CK?

   • AUse the ATT&CK Navigator to load the report and automatically generate a list of adversary groups.
   • BIdentify the malware family used and search for its CVE identifiers to determine the adversary group.
   • CClassify the report by the operating system platform it mentions, then assign it to the corresponding ATT&CK matrix.
   • DMap the observed behaviors to ATT&CK techniques, then group them under the corresponding tactics to identify the adversary's TTPs.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is documenting an incident where an attacker used a compromised VPN account to access the internal network, then used RDP to move to other hosts. Which ATT&CK techniques should the analyst record for these behaviors?

   • AT1566 (Phishing) and T1059 (Command and Scripting Interpreter)
   • BT1078 (Valid Accounts) and T1021 (Remote Services)
   • CT1003 (OS Credential Dumping) and T1550 (Use Alternate Authentication Material)
   • DT1190 (Exploit Public-Facing Application) and T1047 (WMI)
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an incident response, an analyst observes that an attacker used a vulnerability in a public-facing web application to gain initial access, then moved laterally to a database server using valid credentials. Which ATT&CK tactics and techniques best describe these behaviors?

   • AExecution (T1059) and Persistence (T1547)
   • BInitial Access (T1190) and Lateral Movement (T1078)
   • CCredential Access (T1003) and Discovery (T1087)
   • DDefense Evasion (T1070) and Exfiltration (T1041)
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security architect is planning to use ATT&CK to assess risks in an environment that includes Windows servers, Linux workstations, and AWS cloud resources. Which ATT&CK matrix or matrices should they use?

   • AOnly the enterprise matrix, because it covers Windows, Linux, and cloud platforms.
   • BThe mobile matrix for all platforms, since it is the most comprehensive.
   • CThe ICS matrix for cloud resources, since cloud is an industrial control system.
   • DA combination of the enterprise and mobile matrices, because cloud is considered mobile.
   Reveal Solution Discussion Select an answer first