Adversary Emulation Fundamentals GASAE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An emulation team is building a scenario based on a threat intelligence report that describes an adversary using PowerShell to download a payload, then creating a scheduled task for persistence, and finally exfiltrating data over HTTPS. The team wants to structure the emulation so that each step can be mapped to a specific detection opportunity. Which approach should they take?

   • AUse a single automated tool that chains all actions together and only check the final alert to see if the overall campaign was detected.
   • BMap each action to the corresponding MITRE ATT&CK tactic and technique (e.g., Execution, Persistence, Exfiltration) before running the emulation, then execute each technique and validate the associated detections.
   • CExecute the steps in the order described and record which SIEM rules fire, then map the alerts to the MITRE ATT&CK techniques used.
   • DSkip the ATT&CK mapping and instead focus on reproducing the exact commands from the threat report to ensure fidelity.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An adversary emulation engagement has ended, and the team is preparing the final report. The report will be shared with both technical staff and senior management. The team wants to ensure that the report drives action and is understood by both audiences. What is the best approach for structuring the report?

   • APresent the report only verbally to management and provide the technical details only to the security team.
   • BCreate an executive summary that highlights key risks and recommendations, and a separate technical appendix with detailed findings.
   • CFocus the report only on the technical details, because management is not interested in the specifics.
   • DProvide a single detailed technical report with all findings, and let each audience read the relevant sections.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   During an emulation, the team needs to execute a technique that requires administrative privileges on a target Windows server. The team has credentials for a standard user account but not for an administrator. The rules of engagement allow privilege escalation as long as it does not affect other systems. What is the best course of action?

   • AAsk the system administrator to provide administrator credentials.
   • BAttempt to exploit a known local privilege escalation vulnerability on the target server.
   • CUse a denial-of-service attack to force the server to restart and gain admin access.
   • DSkip the privilege escalation and run the technique with standard user privileges.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has a mature security program and wants to test its detection and response capabilities against a specific threat actor. The company also wants to minimize the risk of the emulation being detected by the SOC, because they want to test the SOC's ability to detect an actual attack. However, the legal team requires full transparency and approval of all actions. What is the best way to reconcile these conflicting requirements?

   • AConduct a covert emulation without informing the SOC, but obtain legal approval for the specific techniques in advance.
   • BInform the SOC of the emulation and ask them not to respond to alerts.
   • CSkip legal approval and run the emulation covertly to ensure realism.
   • DRun the emulation as a red team exercise with no rules of engagement.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   After an adversary emulation, the security team finds that a detection rule fired, but the alert was not investigated by the SOC because it was a low-priority alert. The team wants to improve the response process. What is the most effective improvement to recommend?

   • ATune the rule to reduce false positives, and provide additional context in the alert to help the SOC prioritize it correctly.
   • BIncrease the priority of the alert so that it is always investigated immediately.
   • CDisable the rule because it is not being investigated.
   • DRequire the SOC to investigate every alert, regardless of priority.
   Reveal Solution Discussion Select an answer first