Adversary Emulation Fundamentals GASAE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A threat intelligence report indicates that a particular adversary group typically uses a specific remote access tool (RAT) and a unique domain generation algorithm (DGA) for C2. The emulation team wants to validate their network detections for this group. What is the most realistic approach?

   • ABlock the known DGA domains in the firewall and assume the detection is effective.
   • BEmulate the RAT's network behavior and generate C2 traffic using the same DGA pattern in a lab.
   • COnly review the threat intelligence report and update the detection rules without testing.
   • DUse a completely different RAT to avoid detection by the SOC.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   An organization wants to test its security controls by having a team mimic the specific behaviors of a known threat group, using the same tools and techniques that group is known to use. Which activity best describes this approach?

   • APenetration testing
   • BRed teaming
   • CVulnerability scanning
   • DAdversary emulation
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team is asked to validate whether their SIEM detections would fire against a specific ransomware group that has been observed using living-off-the-land binaries and scheduled tasks for persistence. The team wants to simulate that group's behavior without causing disruption to production systems. Which approach best matches this requirement?

   • APerform a red team exercise with no prior knowledge given to the defenders and no restrictions on the techniques used.
   • BConduct a penetration test focused on exploiting known vulnerabilities in internet-facing systems.
   • CRun an adversary emulation exercise in a segmented lab using the MITRE ATT&CK techniques attributed to that ransomware group.
   • DDeploy a honeypot in the production network to capture real attacker behavior.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An intelligence report describes an adversary that uses spear-phishing emails with malicious Office documents, then employs PowerShell to download additional tools, and finally uses scheduled tasks for persistence. The emulation team needs to structure their playbook to align with industry-standard terminology. Which mapping should they use?

   • AAssign each step to a phase of the Cyber Kill Chain, such as Delivery, Exploitation, and Installation.
   • BMap each step to the corresponding MITRE ATT&CK tactic and technique, such as Initial Access, Execution, and Persistence.
   • CClassify each step as a vulnerability category from the OWASP Top 10.
   • DLabel each step as a stage in the NIST incident response lifecycle.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is asked to test the organization's ability to detect a specific threat actor. The team has a threat intelligence report that describes the actor's TTPs. However, the report is based on a single incident and may not be fully representative of the actor's behavior. The team must decide how to proceed. What is the best approach?

   • AWait until more threat intelligence is available before running the emulation.
   • BRely solely on the report because it is the most specific source available.
   • CUse the report as the basis for the emulation, but also incorporate additional threat intelligence from other sources to broaden the scenario.
   • DRun a generic emulation that is not based on any specific threat actor.
   Reveal Solution Discussion Select an answer first