What is the primary reason for executing adversary emulation activities in a controlled environment?

To prevent unintended damage to production systems

To make the emulation more realistic

To ensure the emulation is fully automated

To reduce the need for skilled personnel

A company is planning an adversary emulation to test its incident response procedures. The board has approved the engagement but requires that customer data remain protected and that the emulation not disrupt business operations. Which rules of engagement element is most critical to define upfront?

The names of the emulation team members.

The color of the emulation team's hats.

A clear list of prohibited actions, such as accessing customer data or causing denial of service.

The total budget for the emulation engagement.

What is the primary goal of validating security controls against emulated adversary actions?

To measure the performance of the emulation team

To determine if the controls detect and respond to the emulated actions

To identify all vulnerabilities in the environment

To ensure the emulation is completed on time

What is the primary purpose of the 'lessons learned' phase in adversary emulation?

To create a new threat intelligence report

To document the emulation team's performance

To identify improvements for security controls and processes

GIAC AI Security Automation Engineer

Domain 3Objective 2

Adversary Emulation Fundamentals GASAE Practice Questions (Page 2)

Part of the AI and Adversary Emulation domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 6–10

6foundation · easy
What is the primary reason for executing adversary emulation activities in a controlled environment?
Select an answer first
7foundation · easy
A security analyst observes an attacker using PowerShell to download and execute a payload. In MITRE ATT&CK, which element would 'PowerShell' be classified as?
Select an answer first
8application · medium
A company is planning an adversary emulation to test its incident response procedures. The board has approved the engagement but requires that customer data remain protected and that the emulation not disrupt business operations. Which rules of engagement element is most critical to define upfront?
Select an answer first
9foundation · easy
What is the primary goal of validating security controls against emulated adversary actions?
Select an answer first
10foundation · easy
What is the primary purpose of the 'lessons learned' phase in adversary emulation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASAE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASAE” is a trademark of its owner, used for identification only.