Cyber Kill Chain and MITRE ATT&CK Frameworks CTIA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A detection engineer is reviewing a technique in ATT&CK and notices that it has multiple sub-techniques, such as 'Registry Run Keys / Startup Folder' under 'Boot or Logon Autostart Execution'. Why is it useful to track techniques at the sub-technique level?

   • AIt ensures that all techniques are unique across the matrix.
   • BIt simplifies the framework by reducing the number of techniques.
   • CIt provides more granular detection opportunities and specific mitigation guidance.
   • DIt allows mapping to the Cyber Kill Chain phases more easily.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which activity is an example of actions on objectives?

   • AInstalling a rootkit
   • BScanning the target network for open ports
   • CExfiltrating sensitive data from the target network
   • DSending a spear-phishing email
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of the installation phase in the Cyber Kill Chain?

   • ATo exploit a vulnerability
   • BTo exfiltrate data
   • CTo deliver the payload to the target
   • DTo establish persistence on the compromised system
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A penetration tester is conducting a security assessment for a client. The tester wants to gather information about the client's employees from public sources such as LinkedIn and corporate websites, without directly interacting with the client's systems. Which type of reconnaissance is the tester performing?

   • APassive reconnaissance
   • BDelivery
   • CActive reconnaissance
   • DWeaponization
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security architect is designing a detection strategy for a company that has a mix of on-premises and cloud workloads. They want to use both the Cyber Kill Chain and MITRE ATT&CK to identify gaps. The company has strong email security and endpoint detection, but limited visibility into cloud APIs. Which gap is most likely to be identified by mapping the attack lifecycle to ATT&CK?

   • ALack of detection for cloud API abuse, such as unauthorized use of credentials to access cloud resources
   • BLack of network segmentation between on-premises and cloud
   • CMissing endpoint detection for malware
   • DInsufficient email filtering for phishing
   Reveal Solution Discussion Select an answer first