MITRE ATT&CK Framework CEH Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security team is using ATT&CK Navigator to manage coverage for multiple business units with different risk profiles. They want to create a single view that shows which techniques are covered across all units, and which are covered by only some units. What is the best way to use Navigator layers to achieve this?

   • ACreate a single layer that includes all techniques and manually mark them as covered if any unit covers them.
   • BExport each layer to a spreadsheet and manually compare them.
   • CCreate a layer for each business unit's coverage, then use the Navigator's layer operations to combine them (e.g., union or intersection).
   • DUse the Navigator's scoring feature to average the coverage scores across units.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A threat intelligence analyst is reviewing a report about a campaign targeting Linux web servers. The report describes the following sequence: exploitation of an unpatched Apache vulnerability, creation of a hidden user account, and use of crontab to maintain persistence. The analyst wants to compare this campaign with known adversary groups in the MITRE ATT&CK framework. Which approach is most appropriate for this comparison?

   • AMap the actions to the ICS matrix because the campaign targets servers, which are considered industrial control systems.
   • BFocus only on the initial exploitation technique, since the first action is the most reliable indicator of group attribution.
   • CUse the ATT&CK Navigator to overlay the campaign's techniques on the Windows matrix, since most groups are documented there.
   • DSearch the ATT&CK for Linux platform and map the described actions to techniques, then compare the technique set with group profiles.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   An organization wants to identify which ATT&CK techniques are not covered by its current security controls. Which process best describes this activity?

   • AIncident response
   • BGap analysis
   • CPenetration testing
   • DThreat modeling
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A blue team is building a detection strategy for a Windows environment. They want to prioritize monitoring for techniques that are commonly used by ransomware groups. Using ATT&CK, which approach would best improve their detection capabilities?

   • AImplement detections for all techniques in the ATT&CK enterprise matrix to ensure comprehensive coverage.
   • BUse the ATT&CK Navigator to color-code all techniques in red to indicate they need monitoring.
   • CFocus on techniques used by ransomware groups, such as data encryption and impact, and map them to relevant data sources and analytics.
   • DDeploy a SIEM and ingest all Windows event logs, then let the SIEM automatically detect any ATT&CK technique.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security team is performing a gap analysis to identify weaknesses in their detection coverage. They have mapped their current detections to the ATT&CK framework and found that they have strong coverage for initial access and execution but weak coverage for persistence and exfiltration. Which action is most appropriate based on this analysis?

   • AReallocate detection resources from initial access and execution to persistence and exfiltration.
   • BFocus only on exfiltration since it is the final step of the attack chain.
   • CIgnore the gap analysis and continue with the current detection strategy.
   • DRemove all detections for initial access and execution since they are already well covered.
   Reveal Solution Discussion Select an answer first