Tactics, Techniques, and Procedures (TTPs) SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC manager wants to improve the team's incident response process. The team often spends time identifying the scope of an attack after the initial alert. Which of the following best demonstrates the value of TTPs in improving incident response?

   • ATTPs allow the team to predict the attacker's next move based on the observed techniques
   • BTTPs guarantee the attacker will be identified
   • CTTPs eliminate the need for threat intelligence feeds
   • DTTPs help the team identify all systems affected by searching for the same techniques and procedures across the environment
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During a threat hunt, an analyst discovers that an attacker used a legitimate Windows tool (e.g., `rundll32.exe`) to execute a malicious DLL that then created a scheduled task for persistence. The analyst wants to determine if this is part of a known campaign. Which of the following best uses TTPs to make that determination?

   • ALook up the IP address that the DLL connected to
   • BCompare the DLL hash against a public malware repository
   • CCheck the scheduled task name against a list of known malicious task names
   • DSearch threat intelligence reports for the combination of rundll32 execution and scheduled task creation
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An organization has been targeted by an adversary that uses a specific technique for persistence (creating a new user account) and a specific procedure for lateral movement (using RDP to a specific server). The SOC has limited resources and must choose between two detection strategies: (1) monitoring for new user account creation, or (2) monitoring for RDP connections to the specific server. Which strategy is more effective for detecting the adversary's lateral movement behavior?

   • AMonitoring for new user account creation
   • BMonitoring for RDP connections to the specific server
   • CBoth strategies are equally effective
   • DNeither strategy is effective
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC is reviewing a threat intelligence report that describes an adversary's TTPs. The report indicates the adversary uses a specific technique for defense evasion (disabling security tools) and a specific procedure for exfiltration (using FTP to a specific server). The SOC wants to implement a detection strategy that is resilient to changes in the adversary's malware. Which approach is most effective?

   • ABlock all FTP traffic
   • BSearch for the malware hash from the report
   • CDisable all security tools to prevent the adversary from disabling them
   • DMonitor for the specific FTP server and exfiltration pattern
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An organization has been targeted by an adversary that uses a specific technique for initial access (exploiting a public-facing application) and a specific procedure for persistence (modifying a service configuration). The SOC has limited resources and must choose between two detection strategies: (1) monitoring for the specific service configuration change, or (2) monitoring for exploitation attempts against the public-facing application. Which strategy is more effective for detecting the adversary's persistence behavior?

   • ABoth strategies are equally effective
   • BMonitoring for exploitation attempts against the public-facing application
   • CNeither strategy is effective
   • DMonitoring for the specific service configuration change
   Reveal Solution Discussion Select an answer first