Indicators of Compromise (IoC) and MITRE ATT&CK TIE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is evaluating a new EDR tool. The vendor claims that the tool is 'ATT&CK-aligned' and can detect all techniques. The team wants to verify this claim before purchasing. Which approach is most effective?

   • AReview the vendor's documentation to see which techniques are covered.
   • BTrust the vendor's claim because ATT&CK alignment is a standard certification.
   • CRun a proof-of-concept that emulates a subset of techniques relevant to the organization's threat model and evaluate detection.
   • DAsk other customers for their experience with the tool.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst at a mid-sized firm discovers a suspicious file on a workstation. The file's SHA-256 hash matches a known malware sample, and the analyst also observes the malware attempting to connect to a specific external IP address. The analyst wants to share these findings with the incident response team so they can check other systems for the same compromise. Which combination of IoCs should the analyst prioritize in the report?

   • ARegistry key and file hash
   • BDomain name and file hash
   • CIP address and registry key
   • DFile hash and network IP address
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In the MITRE ATT&CK framework, what does a 'tactic' represent?

   • AThe 'what' of an attack—the specific tool or malware used
   • BThe 'who' of an attack—the threat actor group
   • CThe 'why' of an attack—the adversary's objective or goal
   • DThe 'how' of an attack—the specific method used
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A threat intelligence team maintains a list of malicious IP addresses and domains that were observed in a phishing campaign three months ago. The campaign has ended, and the infrastructure has been sinkholed. The team is deciding whether to keep these IoCs in their active blocklist. What is the most appropriate action according to IoC lifecycle management?

   • AReview their current relevance, deprioritize or retire them if no longer valid, and document the decision.
   • BRetire them immediately and remove them from all detection systems.
   • CKeep them but lower the alert severity to avoid alert fatigue.
   • DKeep them active indefinitely because older IoCs are more reliable.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team wants to improve their detection capabilities by using MITRE ATT&CK. They have a SIEM that can ingest logs from endpoints and network devices. Which approach best leverages ATT&CK to improve detection?

   • AMap all IoCs to ATT&CK techniques to automatically generate SIEM rules
   • BUse ATT&CK to replace the SIEM's correlation rules
   • COnly use ATT&CK for post-incident analysis, not for proactive detection
   • DCreate detection rules based on ATT&CK techniques and map them to relevant data sources
   Reveal Solution Discussion Select an answer first