A security architect is explaining the value of the MITRE ATT&CK framework to a colleague who is unfamiliar with it. The architect wants to emphasize how ATT&CK differs from a traditional vulnerability scan. Which statement best describes this difference?

ATT&CK is used for penetration testing, while vulnerability scans are used for incident response.

ATT&CK focuses on the tactics and techniques used by adversaries, while vulnerability scans focus on identifying known software weaknesses.

ATT&CK is a vulnerability database, while vulnerability scans are a list of adversary behaviors.

ATT&CK provides a list of known malware signatures, while vulnerability scans detect zero-day exploits.

A security consultant is assessing an organization that operates a wind farm with industrial control systems and also has a corporate Windows network. They want to use ATT&CK to assess both environments. Which matrices should they use?

Use only the enterprise matrix because it covers all platforms including ICS.

Use the mobile matrix for both because it covers all types of devices.

Use the ICS matrix for the wind farm and the enterprise matrix for the corporate network.

Use only the ICS matrix because it is the most comprehensive.

A threat intelligence team is analyzing a series of intrusions that share similar TTPs but target different platforms: one on Windows, one on Linux, and one on AWS. They want to determine if the same adversary group is responsible. Which approach using ATT&CK would best support this attribution analysis?

Use the ATT&CK Navigator to merge all three intrusions into one layer and assume they are the same group.

Compare the techniques used across the intrusions, considering platform-specific variations of the same technique.

Attribute the intrusions to different groups because ATT&CK matrices are platform-specific and cannot be compared.

Focus only on the malware families observed and compare their hashes.

An incident responder is analyzing a breach where the attacker first gained access via a phishing email, then used a JavaScript file to download malware, and finally established persistence by modifying a registry run key. Which sequence of ATT&CK tactics best describes this attack chain?

Defense Evasion, Discovery, Exfiltration

Reconnaissance, Resource Development, Initial Access

Initial Access, Execution, Persistence

Credential Access, Lateral Movement, Collection

EC-CouncilCertified Ethical Hacker

Domain 1Objective 6

MITRE ATT&CK Framework CEH Practice Questions (Page 5)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 21–25

21application · medium
A security architect is explaining the value of the MITRE ATT&CK framework to a colleague who is unfamiliar with it. The architect wants to emphasize how ATT&CK differs from a traditional vulnerability scan. Which statement best describes this difference?
Select an answer first
22application · medium
A security consultant is assessing an organization that operates a wind farm with industrial control systems and also has a corporate Windows network. They want to use ATT&CK to assess both environments. Which matrices should they use?
Select an answer first
23expert · hard
A threat intelligence team is analyzing a series of intrusions that share similar TTPs but target different platforms: one on Windows, one on Linux, and one on AWS. They want to determine if the same adversary group is responsible. Which approach using ATT&CK would best support this attribution analysis?
Select an answer first
24foundation · easy
In the MITRE ATT&CK framework, which component represents the 'why' of an adversary's action—the objective or goal they are trying to achieve?
Select an answer first
25application · medium
An incident responder is analyzing a breach where the attacker first gained access via a phishing email, then used a JavaScript file to download malware, and finally established persistence by modifying a registry run key. Which sequence of ATT&CK tactics best describes this attack chain?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

MITRE ATT&CK Framework CEH Practice Questions (Page 5)

Questions 21–25

A security architect is explaining the value of the MITRE ATT&CK framework to a colleague who is unfamiliar with it. The architect wants to emphasize how ATT&CK differs from a traditional vulnerability scan. Which statement best describes this difference?

A security consultant is assessing an organization that operates a wind farm with industrial control systems and also has a corporate Windows network. They want to use ATT&CK to assess both environments. Which matrices should they use?

In the MITRE ATT&CK framework, which component represents the 'why' of an adversary's action—the objective or goal they are trying to achieve?

An incident responder is analyzing a breach where the attacker first gained access via a phishing email, then used a JavaScript file to download malware, and finally established persistence by modifying a registry run key. Which sequence of ATT&CK tactics best describes this attack chain?

Keep studying — Information Security and Ethical Hacking Overview