A threat intelligence analyst is comparing a new incident's TTPs to a known adversary group's profile in ATT&CK. The incident shows use of PowerShell for execution and WMI for lateral movement. Which ATT&CK techniques would the analyst likely use for comparison?

T1059 (Command and Scripting Interpreter) and T1047 (Windows Management Instrumentation)

T1566 (Phishing) and T1190 (Exploit Public-Facing Application)

T1055 (Process Injection) and T1543 (Create or Modify System Process)

T1003 (OS Credential Dumping) and T1078 (Valid Accounts)

What is the primary purpose of the MITRE ATT&CK framework?

To replace the need for penetration testing by providing automated vulnerability scanning

To provide a standardized taxonomy of adversary behaviors based on real-world observations

To serve as a legal framework for prosecuting cybercriminals

To define a set of mandatory security controls that all organizations must implement

EC-CouncilCertified Ethical Hacker

Domain 1Objective 6

MITRE ATT&CK Framework CEH Practice Questions (Page 9)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 41–43

41application · medium
A threat intelligence analyst is comparing a new incident's TTPs to a known adversary group's profile in ATT&CK. The incident shows use of PowerShell for execution and WMI for lateral movement. Which ATT&CK techniques would the analyst likely use for comparison?
Select an answer first
42foundation · easy
What is the primary purpose of the MITRE ATT&CK framework?
Select an answer first
43foundation · easy
In a threat hunting scenario, an analyst uses ATT&CK to formulate hypotheses about adversary behavior. Which ATT&CK component is most useful for generating specific hunting leads?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

MITRE ATT&CK Framework CEH Practice Questions (Page 9)

Questions 41–43

A threat intelligence analyst is comparing a new incident's TTPs to a known adversary group's profile in ATT&CK. The incident shows use of PowerShell for execution and WMI for lateral movement. Which ATT&CK techniques would the analyst likely use for comparison?

What is the primary purpose of the MITRE ATT&CK framework?

In a threat hunting scenario, an analyst uses ATT&CK to formulate hypotheses about adversary behavior. Which ATT&CK component is most useful for generating specific hunting leads?

Keep studying — Information Security and Ethical Hacking Overview