A security operations team has limited resources and must improve detection coverage for a high-risk adversary group. They have a list of techniques used by the group and their current detection coverage. Some techniques have partial coverage, some have none, and some are fully covered. What is the best strategy to maximize detection improvement?

Focus on techniques with no coverage that are also used early in the attack chain, as detecting them earlier may prevent later stages.

Randomly select techniques to improve to avoid bias.

Focus on techniques that are fully covered to ensure they remain effective.

Improve coverage for techniques that already have partial coverage to make them fully effective.

A security manager wants to identify gaps in the organization's security controls against known adversary techniques. They have a list of techniques from the ATT&CK framework and a list of current security tool capabilities. Which method would best conduct a gap analysis?

Compare the organization's security tool coverage against the ATT&CK techniques and identify techniques with no corresponding control or detection.

Review the organization's firewall rules and ensure they block all inbound traffic.

Use the ATT&CK Navigator to automatically generate a list of missing security tools.

Run a vulnerability scanner against all systems and patch any vulnerabilities found.

A security analyst is reviewing a detection alert for a Windows workstation. The alert shows that a PowerShell script downloaded a binary from a remote server and executed it in memory without writing to disk. The analyst needs to map this behavior to the MITRE ATT&CK framework to prioritize the alert. Which combination of tactic and technique best describes this observed behavior?

Execution (T1059) — Command and Scripting Interpreter: PowerShell

Execution (T1204) — User Execution: Malicious File

Defense Evasion (T1140) — Deobfuscate/Decode Files or Information

Initial Access (T1195) — Supply Chain Compromise

EC-CouncilCertified Ethical Hacker

Domain 1Objective 6

MITRE ATT&CK Framework CEH Practice Questions (Page 4)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 16–20

16expert · hard
A security operations team has limited resources and must improve detection coverage for a high-risk adversary group. They have a list of techniques used by the group and their current detection coverage. Some techniques have partial coverage, some have none, and some are fully covered. What is the best strategy to maximize detection improvement?
Select an answer first
17application · medium
A security manager wants to identify gaps in the organization's security controls against known adversary techniques. They have a list of techniques from the ATT&CK framework and a list of current security tool capabilities. Which method would best conduct a gap analysis?
Select an answer first
18application · medium
A security analyst is reviewing a detection alert for a Windows workstation. The alert shows that a PowerShell script downloaded a binary from a remote server and executed it in memory without writing to disk. The analyst needs to map this behavior to the MITRE ATT&CK framework to prioritize the alert. Which combination of tactic and technique best describes this observed behavior?
Select an answer first
19foundation · easy
Within the ATT&CK Enterprise matrix, which of the following platforms is explicitly listed as a separate platform?
Select an answer first
20foundation · easy
When analyzing a threat intelligence report, which ATT&CK component would you use to identify the specific steps an adversary took to carry out a technique?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

MITRE ATT&CK Framework CEH Practice Questions (Page 4)

Questions 16–20

A security manager wants to identify gaps in the organization's security controls against known adversary techniques. They have a list of techniques from the ATT&CK framework and a list of current security tool capabilities. Which method would best conduct a gap analysis?

Within the ATT&CK Enterprise matrix, which of the following platforms is explicitly listed as a separate platform?

When analyzing a threat intelligence report, which ATT&CK component would you use to identify the specific steps an adversary took to carry out a technique?

Keep studying — Information Security and Ethical Hacking Overview