MITRE ATT&CK Framework CEH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When conducting a risk assessment using ATT&CK, which factor is most directly informed by the framework?

   • AThe cost of implementing security controls
   • BThe likelihood of specific adversary techniques being used against the organization
   • CThe legal penalties for non-compliance with regulations
   • DThe financial value of the organization's assets
   Reveal Solution Discussion Select an answer first
2. 7expert · hard · select all that apply

   A security operations team is using ATT&CK to improve detection for a specific adversary group. They have limited budget and need to choose which techniques to focus on. Which of the following are valid considerations when prioritizing techniques for detection? (Select all that apply.)

   • ATechniques that have no current detection coverage should be prioritized over those with partial coverage.
   • BTechniques that are used early in the attack chain may provide earlier detection opportunities.
   • CTechniques that are already fully covered should be improved to ensure they remain effective.
   • DTechniques that are difficult to detect should be ignored to avoid wasting resources.
   • ETechniques that are unique to the adversary group are more valuable for detection than common techniques.
   Check answers Discussion Select an answer first
4. 8application · medium

   A security team is using the ATT&CK Navigator to visualize their detection coverage. They want to highlight techniques that are not covered by any detection and also annotate them with notes for future improvements. Which feature of the ATT&CK Navigator should they use?

   • AThe technique search feature, which finds techniques by name and automatically marks them as covered.
   • BThe layer feature, which allows them to color-code techniques and add annotations.
   • CThe scoring feature, which assigns a risk score to each technique based on CVSS.
   • DThe export feature, which generates a PDF report of all techniques.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security manager is conducting a gap analysis to assess the organization's detection capabilities. The organization has strong endpoint detection and response (EDR) coverage but limited visibility into cloud environments. The manager wants to identify which ATT&CK techniques are most likely under-covered. Which approach is most appropriate?

   • AMap all techniques in the mobile matrix to the organization's cloud infrastructure.
   • BFocus exclusively on the ICS matrix, since cloud environments are not covered by the enterprise matrix.
   • CAssume that EDR coverage is sufficient for all techniques, since endpoints are the primary attack surface.
   • DReview the ATT&CK Navigator heatmap for the enterprise matrix and identify techniques with low coverage scores.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC manager wants to improve threat hunting by focusing on techniques that are often missed by existing detections. They have a list of ATT&CK techniques and their current detection coverage. Which approach would best prioritize hunting activities?

   • AUse the ATT&CK Navigator to automatically generate hunting queries for all techniques.
   • BFocus only on techniques that have existing detections to validate them.
   • CPrioritize techniques that have no detection coverage and are relevant to the organization's threat model.
   • DHunt for all techniques equally to ensure no technique is overlooked.
   Reveal Solution Discussion Select an answer first