Tactics, Techniques, and Procedures (TTPs) SCE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC team is designing a detection strategy for a new threat group that is known to use a variety of techniques, including spear-phishing, drive-by compromise, and exploitation of public-facing applications. The team has limited resources and must prioritize which techniques to build detections for. Which approach best balances coverage and resource constraints?

   • AFocus only on the techniques that are easiest to detect, such as spear-phishing, and ignore the others
   • BWait for a confirmed incident before building any detections
   • CPrioritize detections for techniques that target the environment's most exposed and vulnerable assets, and that are most likely to be used based on the group's TTPs
   • DBuild detections for all known techniques used by the group, regardless of the environment's attack surface
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC team is reviewing a threat intelligence report that describes an adversary's TTPs. The report indicates the adversary uses a specific technique for initial access and a specific procedure for persistence. How can the SOC best use this information to improve their detection capabilities?

   • ADevelop detection rules that monitor for the specific procedure used for persistence
   • BWait for the next attack to occur before taking action
   • CSearch for the specific malware hash mentioned in the report
   • DBlock all traffic from the adversary's known IP addresses
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC analyst is analyzing a series of alerts. In one alert, an attacker used a legitimate remote desktop tool to connect to a server and then ran a script to disable security software. In another alert, the same attacker used a different remote desktop tool but the same script to disable security software. Which TTP component is most useful for correlating these two alerts as the same adversary?

   • AThe procedure, because the exact script used to disable security software is likely unique to the adversary
   • BThe tactic, because both alerts show the goal of disabling security software
   • CThe tool, because the attacker used a remote desktop tool in both cases
   • DThe technique, because both alerts show the use of remote desktop tools
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company has experienced multiple ransomware incidents. In each case, the attacker gained access via a phishing email, used PowerShell to enumerate the network, and then deployed ransomware via scheduled tasks. The SOC wants to implement proactive defenses. Which of the following best applies TTP knowledge to prevent future incidents?

   • APurchase a threat intelligence feed and block all known ransomware hashes
   • BFocus only on endpoint detection rules for ransomware behavior, such as file encryption
   • CImplement email filtering for phishing, restrict PowerShell execution to approved scripts, and monitor scheduled task creation for suspicious activity
   • DBlock all phishing emails at the email gateway and disable PowerShell across the environment
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why do security analysts study TTPs rather than only focusing on individual indicators of compromise (IOCs)?

   • ABecause TTPs are required by regulatory standards such as GDPR
   • BBecause TTPs provide a higher-level view of adversary behavior that remains consistent even when specific IOCs change
   • CBecause TTPs are easier to detect than IOCs in network traffic
   • DBecause TTPs are automatically generated by security tools without human analysis
   Reveal Solution Discussion Select an answer first