Indicators of Compromise (IoC) and MITRE ATT&CK TIE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A threat intelligence team has collected a set of IoCs from a recent phishing campaign: a malicious attachment hash, a C2 domain, and a registry key that the malware creates. The team wants to use MITRE ATT&CK to enhance their detection strategy. Which approach best utilizes ATT&CK in this context?

   • AMap the IoCs to relevant techniques and tactics to identify detection gaps
   • BSubmit the IoCs to MITRE for inclusion in the ATT&CK framework
   • CReplace the IoCs with ATT&CK techniques in the detection rules
   • DUse ATT&CK to prioritize IoCs based on their hash values
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is it important to manage Indicators of Compromise (IoCs) throughout their lifecycle?

   • ATo comply with international data protection regulations
   • BTo eliminate the need for human analysts in threat detection
   • CTo increase the number of IoCs in the threat intelligence feed
   • DTo ensure that IoCs remain accurate and relevant for detection
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A threat intelligence team is creating a report for executives. The report needs to explain the risk of a specific threat actor. The team has mapped the actor's TTPs to MITRE ATT&CK. Which presentation of the data is most useful for executives?

   • AA list of all the techniques the actor uses, with technical descriptions.
   • BA comparison of the actor's TTPs to other threat actors.
   • CA heatmap showing the tactics and techniques the actor uses, with a summary of the potential business impact.
   • DA detailed timeline of the actor's campaigns, including IoCs.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security analyst is investigating an alert that shows a process making an HTTP request to a domain that is not on any blocklist. The analyst wants to determine if this is malicious. The analyst has access to MITRE ATT&CK and a sandbox. Which approach is most effective?

   • ABlock the domain immediately because it is not on any blocklist.
   • BUse the sandbox to execute the process and observe its behavior, then map the behavior to ATT&CK techniques.
   • CSearch the internet for the domain to see if it is known.
   • DIgnore the alert because the domain is not on any blocklist.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of the MITRE ATT&CK framework?

   • ATo provide a list of known malware signatures for antivirus products
   • BTo provide a standardized taxonomy of adversary behaviors based on real-world observations
   • CTo offer a vulnerability scoring system for software flaws
   • DTo define a set of security controls for compliance audits
   Reveal Solution Discussion Select an answer first