Adversary Emulation Fundamentals GASAE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is asked to validate whether their SIEM detections would fire if an attacker used the same initial access method and post-exploitation behavior as the group that recently breached a peer organization. They have a full copy of the threat report and a lab that mirrors production. The team wants to avoid the noise and legal overhead of a full red team engagement. Which approach best meets their goal?

   • AReview the threat report and manually compare the listed indicators of compromise against current SIEM rules without executing any actions.
   • BRun a penetration test focused on exploiting the same vulnerability, then manually verify if the SIEM logs the exploit attempt.
   • CConduct an adversary emulation exercise that maps the threat report to MITRE ATT&CK and executes the corresponding TTPs in the lab, then checks SIEM alerts for each step.
   • DDeploy a red team to attempt any means of gaining access, with the goal of testing the organization's overall security posture without a predefined playbook.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   After executing an emulation of an adversary's command and control (C2) communication using a common HTTP beacon, the SOC reports that their network monitoring tool did not alert. The emulation team needs to determine whether the detection gap is due to a missing rule or a limitation of the tool. What is the best next step?

   • AReview the network monitoring tool's logs to confirm the beacon traffic was observed but not flagged.
   • BDisable the network monitoring tool to avoid false positives during the rest of the emulation.
   • CRe-run the emulation with a different C2 technique, such as DNS tunneling.
   • DImmediately escalate the issue to the SOC manager as a critical incident.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In the MITRE ATT&CK framework, what is the correct hierarchy from broad to specific?

   • AProcedures → Techniques → Tactics
   • BTechniques → Tactics → Procedures
   • CTactics → Techniques → Procedures
   • DTactics → Procedures → Techniques
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of integrating threat intelligence reports into adversary emulation planning?

   • ATo generate compliance reports
   • BTo ensure the emulation accurately reflects the TTPs of a real adversary
   • CTo automate the emulation process
   • DTo replace the need for a red team
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During an emulation exercise, the team needs to execute a technique that mimics an adversary using Windows Management Instrumentation (WMI) for remote execution. The environment is a controlled lab with Windows endpoints. Which tool or method is most appropriate for this task?

   • AUse a built-in Windows command such as wmic to run a process on a remote host.
   • BUse a PowerShell script that only runs locally on the source host.
   • CDeploy a custom kernel driver to the remote host to execute the process.
   • DSend an email with a malicious attachment to the target host.
   Reveal Solution Discussion Select an answer first