MITRE ATT&CK Framework CEH Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard · select all that apply

   A risk assessment team is using ATT&CK to identify gaps in their security posture. They have a coverage layer in ATT&CK Navigator and a list of techniques used by a threat group that targets their industry. Which of the following are valid steps in this gap analysis process? (Select all that apply.)

   • AOverlay the threat group's techniques with the coverage layer to identify techniques used by the group that are not covered.
   • BPrioritize gaps that are associated with techniques that have no coverage and are used by the threat group.
   • CUse the ATT&CK Navigator to automatically generate remediation steps for uncovered techniques.
   • DAssign a risk score to each technique based on the likelihood and impact of the technique being used against the organization.
   • EIgnore techniques that are not used by the threat group, even if they have no coverage.
   Check answers Discussion Select an answer first
2. 32expert · hard

   A security architect is conducting a gap analysis for a hybrid environment (on-premises Windows and Azure). They have a coverage layer in ATT&CK Navigator showing which techniques have detections. They also have a list of techniques used by a threat group that targets hybrid environments. Which approach would best identify the most critical gaps?

   • AUse the Navigator's scoring feature to rank all techniques by CVSS and focus on high scores.
   • BFocus on techniques that are unique to Azure, ignoring on-premises techniques.
   • CReview all techniques in the enterprise matrix and implement detections for all of them.
   • DOverlay the threat group's techniques with the coverage layer and prioritize gaps that are relevant to the group's TTPs.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A threat intelligence analyst is trying to attribute an intrusion to a known adversary group. The intrusion used techniques that are common across many groups, such as spear-phishing and PowerShell. The analyst also found a rare technique: use of a specific USB-based attack. Which approach would best support attribution?

   • AIgnore the rare technique because it might be a false positive.
   • BAttribute the intrusion to a new group because the combination of techniques is unique.
   • CUse the common techniques to attribute to the group that uses them most frequently.
   • DFocus on the rare technique and compare it to the profiles of known groups that use that technique.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security researcher is analyzing a malware sample that targets both Windows workstations and Android mobile devices. The researcher wants to document the techniques used by this malware in a structured format that covers both platforms. Which approach is most appropriate?

   • ADocument the techniques in the enterprise matrix only, since it covers all platforms including mobile.
   • BCreate a custom matrix that combines techniques from all platforms into a single view.
   • CUse the mobile matrix for the Android techniques and the enterprise matrix for the Windows techniques.
   • DUse the ICS matrix for both, since it is the most comprehensive matrix.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security operations team wants to improve its detection coverage for a specific adversary group that is known to use PowerShell for reconnaissance and then exfiltrate data over HTTPS. The team uses a SIEM that can ingest Windows event logs and network flow data. Which approach best aligns their monitoring with the ATT&CK framework to detect this group's behavior?

   • AEnable PowerShell script block logging and monitor for suspicious script content, and configure network monitoring for anomalous HTTPS traffic volumes.
   • BFocus only on network monitoring for HTTPS traffic, since the exfiltration is the most critical step.
   • CCreate detections for all techniques in the ATT&CK framework to ensure comprehensive coverage.
   • DDeploy the ATT&CK Navigator to automatically block all techniques associated with the group.
   Reveal Solution Discussion Select an answer first