MITRE ATT&CK Framework CEH Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   How can a security operations center (SOC) use the ATT&CK framework to improve its detection capabilities?

   • ABy using ATT&CK to generate firewall rules that block all malicious traffic
   • BBy mapping detection rules and analytics to specific ATT&CK techniques to identify gaps in coverage
   • CBy using ATT&CK to automatically patch vulnerabilities in the network
   • DBy replacing the SIEM with ATT&CK as the primary monitoring platform
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team is conducting a gap analysis using the ATT&CK Navigator. They have mapped their current detections and found that they have good coverage for techniques in the 'Execution' and 'Persistence' tactics but poor coverage for techniques in the 'Exfiltration' and 'Impact' tactics. The team has a limited budget and must decide how to allocate resources. Which approach is most effective for improving their overall security posture?

   • AFocus on improving coverage for exfiltration techniques, since they are more likely to be detected than impact techniques.
   • BAllocate resources equally to both exfiltration and impact techniques to ensure balanced coverage.
   • CPrioritize based on the organization's risk assessment, which identifies exfiltration as a higher risk than impact.
   • DFocus on improving coverage for impact techniques, since they represent the final stage of an attack and are the most damaging.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary function of the MITRE ATT&CK Navigator?

   • ATo replace the need for a SIEM by generating real-time alerts
   • BTo provide a visual, interactive representation of ATT&CK matrices for annotating and analyzing technique coverage
   • CTo store and manage vulnerability scan results
   • DTo automatically execute attack techniques against a target network
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A threat intelligence analyst is comparing a new campaign to known adversary groups. The campaign uses a previously unknown malware family that leverages Windows Management Instrumentation (WMI) for execution and uses a custom protocol for command and control. The analyst has identified two potential groups: Group A is known to use WMI for execution but uses HTTP for C2, and Group B is known to use PowerShell for execution but uses a custom protocol for C2. Which group is more likely responsible for the campaign?

   • AGroup B, because the custom C2 protocol is more distinctive than the execution technique.
   • BGroup A, because the WMI execution technique is more distinctive than the C2 protocol.
   • CNeither group is a strong match, because the campaign uses a combination of techniques that does not fully align with either group.
   • DBoth groups are equally likely, since each matches one of the two key techniques.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   A threat intelligence report describes an adversary that uses PowerShell scripts to download and execute payloads, then uses Mimikatz to extract credentials. How would a security analyst use ATT&CK to attribute this behavior to a known group?

   • ABy matching the observed techniques and procedures to those associated with known groups in ATT&CK
   • BBy checking the IP addresses in the report against ATT&CK's database of malicious IPs
   • CBy running the PowerShell script through ATT&CK's automated malware analysis tool
   • DBy comparing the malware's hash to ATT&CK's list of known malware hashes
   Reveal Solution Discussion Select an answer first