Adversary Emulation Fundamentals GASAE Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   After an emulation engagement, the team wants to ensure that the lessons learned lead to tangible improvements. Which action best supports this goal?

   • AArchive the report and only share it with the emulation team.
   • BCreate a prioritized remediation plan with owners and deadlines for each detection gap identified.
   • CConclude that the emulation was successful because no major incidents occurred.
   • DRepeat the same emulation immediately to confirm the findings.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   After an adversary emulation, the security team finds that their EDR did not alert on a technique that the threat intelligence report indicated the adversary uses. The team wants to improve their detection capabilities. Which action is most aligned with the lessons-learned process?

   • ADocument the missed detection and schedule a follow-up emulation to test the same technique after tuning the EDR.
   • BImmediately rerun the emulation without any changes to see if the alert appears this time.
   • CAssume the threat intelligence report is inaccurate and ignore the technique.
   • DRemove the technique from the emulation plan because it is not detected.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which outcome indicates a successful validation of a detection control during adversary emulation?

   • AThe control blocked all emulated actions
   • BThe emulation team completed all steps without detection
   • CThe emulation team used the same tools as the adversary
   • DThe control generated an alert for the emulated action
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which source of threat intelligence would be most useful for modeling a specific adversary's behavior in an emulation?

   • AA list of common vulnerability scores
   • BA vendor's marketing whitepaper on security products
   • CA general news article about cybercrime trends
   • DA detailed report on a specific threat group's TTPs
   Reveal Solution Discussion Select an answer first