Cyber Kill Chain and MITRE ATT&CK Frameworks CTIA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of the command and control (C2) phase?

   • ATo exploit a vulnerability
   • BTo deliver the malicious payload
   • CTo establish a communication channel between the attacker and the compromised system
   • DTo install a backdoor
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A detection team is reviewing a technique in ATT&CK and finds that it has several sub-techniques. They need to decide whether to create separate detections for each sub-technique or a single detection for the parent technique. The team has limited engineering resources and wants to maximize coverage while minimizing false positives. Which approach is most appropriate?

   • APrioritize sub-techniques based on the organization's threat model and create detections for the highest-risk ones first
   • BUse the parent technique detection and rely on threat intelligence to identify sub-technique variations
   • CCreate separate detections for each sub-technique to capture specific behaviors
   • DCreate a single detection for the parent technique to cover all sub-techniques
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is reviewing ATT&CK data for an intrusion and notices that the adversary used a technique to obtain credentials from a compromised host. The analyst wants to categorize this behavior under the appropriate ATT&CK tactic. Which tactic best fits the goal of obtaining credentials?

   • APersistence
   • BExecution
   • CDiscovery
   • DCredential Access
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the main objective of the reconnaissance phase in the Cyber Kill Chain?

   • ATo identify potential targets and gather information about them
   • BTo exploit a vulnerability in the target's system
   • CTo deliver the malicious payload to the target
   • DTo establish a command and control channel
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of the Cyber Kill Chain model?

   • ATo list all known vulnerabilities in software products
   • BTo categorize malware based on its family and signature
   • CTo define the legal penalties for cybercrime
   • DTo provide a framework for analyzing and describing the stages of a cyber intrusion
   Reveal Solution Discussion Select an answer first