Indicators of Compromise (IoC) and MITRE ATT&CK TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is reviewing a threat intelligence report that describes an adversary using PowerShell to download and execute a payload. The report also mentions that the adversary uses obfuscation to hide the script. How should the analyst categorize this behavior using MITRE ATT&CK?

   • AExecution (T1059) and Persistence (T1053)
   • BCommand and Control (T1071) and Exfiltration (T1041)
   • CDefense Evasion (T1027) and Credential Access (T1003)
   • DExecution (T1059) and Defense Evasion (T1027)
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A red team exercise is being planned to test the organization's detection capabilities. The blue team wants to use MITRE ATT&CK to evaluate which adversary behaviors they can detect. Which approach best uses ATT&CK for this purpose?

   • ARun the red team exercise without any predefined scenarios to get a baseline.
   • BSelect a set of ATT&CK techniques that are relevant to the organization's threat model and design the exercise to emulate those techniques.
   • CFocus the exercise on testing only the most common malware signatures.
   • DUse ATT&CK to generate a list of all possible techniques and test every one.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of an Indicator of Compromise (IoC) in cybersecurity?

   • ATo encrypt data at rest to prevent unauthorized access during a breach
   • BTo provide a unique identifier for a specific vulnerability in a software product
   • CTo define the security policy for an organization's network perimeter
   • DTo serve as a piece of forensic evidence that indicates a system may have been breached or is under attack
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security architect is designing a detection program for a financial institution. The institution is subject to strict compliance requirements and has a limited security budget. The architect wants to use MITRE ATT&CK to improve detection coverage. Which approach best balances compliance, cost, and effectiveness?

   • AFocus only on techniques that are easy to detect with the current SIEM.
   • BPrioritize techniques that are used by threat actors targeting financial institutions and that are required by compliance frameworks.
   • COutsource all detection to a managed security service provider (MSSP) to reduce costs.
   • DImplement detections for all techniques in the ATT&CK framework to ensure full coverage.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team receives a daily feed of IoCs from a commercial threat intelligence provider. The feed includes IP addresses, domains, and file hashes. The team automatically blocks all IPs and domains in the feed. After a few weeks, they notice that some internal users are unable to access a legitimate cloud service. What is the most likely cause?

   • AThe IoCs in the feed are all false positives.
   • BThe domains in the feed are being used by the cloud service for authentication.
   • CThe file hashes in the feed are blocking the cloud service's executables.
   • DThe IP addresses in the feed are shared by multiple services, including the legitimate cloud service.
   Reveal Solution Discussion Select an answer first