Tactics, Techniques, and Procedures (TTPs) SCE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In the TTP framework, which component represents the adversary's overarching goal or objective?

   • ATechnique
   • BIndicator
   • CProcedure
   • DTactic
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In the context of cybersecurity, what do tactics, techniques, and procedures (TTPs) collectively describe?

   • AThe legal and regulatory requirements that govern incident reporting
   • BThe specific vulnerabilities in a target system that an attacker exploits
   • CThe security controls that an organization deploys to protect its network
   • DThe high-level goals, methods, and detailed steps that characterize an adversary's behavior
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is an example of a technique in the TTP framework?

   • ASpear phishing
   • BUsing a specific PowerShell script to enumerate Active Directory
   • CPersistence
   • DExfiltration
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An organization is investigating an incident where an adversary used a legitimate system tool (PowerShell) to download and execute a payload. The SOC has identified the specific PowerShell command used. The adversary is known to use different commands in different attacks. Which detection strategy is most effective for detecting this adversary's future activity?

   • ABlock all PowerShell execution
   • BCreate a detection rule for the specific PowerShell command
   • CMonitor for PowerShell execution that downloads and executes content
   • DSearch for the payload's file hash
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How does understanding TTPs improve an organization's threat detection capabilities?

   • AIt guarantees that all attacks will be prevented before they occur
   • BIt enables the organization to focus on behavioral patterns rather than relying solely on static indicators
   • CIt eliminates the need for security monitoring tools
   • DIt allows the organization to block all known malicious IP addresses
   Reveal Solution Discussion Select an answer first