Tactics, Techniques, and Procedures (TTPs) SCE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A threat intelligence report describes an adversary that uses a specific technique for initial access (spear-phishing) and a specific procedure for persistence (creating a registry run key). The SOC wants to implement a detection strategy that is resilient to changes in the adversary's malware. Which approach is most effective?

   • ASearch for the malware hash from the report
   • BBlock all incoming email from external domains
   • CCreate a detection rule for the specific registry run key value
   • DDisable the Windows registry editor on all workstations
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC analyst is reviewing an alert about a suspicious process that spawned a command prompt and then made an outbound connection to an IP address known to be a command-and-control (C2) server. The analyst wants to determine if this is a true positive and understand the full scope of the attack. Which action best uses TTPs to support the investigation?

   • ACheck the hash of the suspicious process against a threat intelligence feed and close the alert if it is not flagged
   • BRebuild the affected host from a known-good image and move on
   • CImmediately block the IP address and close the alert
   • DSearch for other occurrences of the same process-parent-child relationship and outbound connections to the same or related C2 infrastructure across the environment
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has experienced multiple phishing attacks that used different malware families but the same lure themes and delivery infrastructure. The SOC wants to improve their proactive defenses. Which approach best leverages TTPs to reduce the impact of future attacks?

   • ADisable email for all users during high-risk periods
   • BIncrease the frequency of antivirus signature updates
   • CBlock all email attachments containing macros
   • DImplement email filtering rules based on the known lure themes and sender infrastructure
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOC is analyzing an adversary that uses a legitimate remote administration tool (RAT) for command and control. The RAT is commonly used by IT administrators, so the SOC cannot simply block it. The adversary uses the RAT to execute commands and move laterally. Which detection strategy best leverages TTPs to identify this adversary's activity?

   • ABlock the RAT's network traffic
   • BSearch for the RAT's file hash
   • CMonitor for unusual usage patterns of the RAT, such as execution outside business hours or from unexpected accounts
   • DDisable the RAT for all users
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A SOC team is evaluating detection coverage for a threat group that uses a variety of living-off-the-land binaries (LOLBins) to perform discovery and lateral movement. The team has limited resources and must choose between two detection strategies: (A) create signatures for the specific command-line patterns observed in past incidents, or (B) create behavioral rules that detect the underlying techniques, such as remote service creation and network share enumeration. Which strategy is more effective for long-term detection of this threat group?

   • ABoth strategies are equally effective because they both detect the same TTPs
   • BStrategy B, because behavioral rules focus on the techniques that the threat group is likely to continue using, even if the specific commands change
   • CStrategy A, because exact command-line patterns are unique to the threat group and will not generate false positives
   • DStrategy A is better because it is easier to implement and requires less tuning
   Reveal Solution Discussion Select an answer first