Adversary Emulation Fundamentals GASAE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which element is most important to include in a final report of an adversary emulation engagement?

   • AA clear summary of findings and recommended actions
   • BA detailed log of every command executed
   • CA comparison of the emulation team's skills
   • DA list of all tools used by the emulation team
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company's threat intelligence team has published a report on a ransomware group that uses spear-phishing with malicious LNK files, then uses living-off-the-land binaries for discovery, and finally deploys ransomware via scheduled tasks. The security operations team wants to run an emulation to test their endpoint detection and response (EDR) coverage. They have a limited maintenance window and cannot disrupt production. Which plan best aligns with the threat report?

   • AEmulate the full chain in a production-like lab, using the same LNK file, LOLBins, and scheduled task technique, then review EDR alerts for each phase.
   • BReview the threat report and update the EDR rules based on the indicators of compromise without executing any emulation.
   • CExecute only the final ransomware deployment step in the lab to minimize time, assuming that if the last step is detected, the earlier steps would also be detected.
   • DRun a generic penetration test that exploits a known vulnerability in the lab, then check if the EDR detects the exploit.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A threat intelligence report provides a list of indicators of compromise (IOCs) for a specific adversary, including file hashes, domains, and IP addresses. The emulation team wants to validate whether their detections can identify the adversary's behavior, not just the IOCs. What is the most effective approach?

   • ACreate a new detection rule for each IOC and assume that the detections are effective.
   • BFocus on emulating the adversary's TTPs, using the IOCs as supplementary validation data.
   • CUse the IOCs to search historical logs for past infections instead of emulating.
   • DOnly test whether the IOCs are blocked by the firewall and blacklisted in the EDR.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   After an emulation engagement, the team finds that the SOC detected only 2 out of 10 emulated techniques. The SOC argues that the missed techniques are not relevant because they are not used by real adversaries in their industry. The emulation team has threat intelligence showing that those techniques are indeed used by a group targeting similar companies. What is the best way to resolve this conflict?

   • AEscalate the issue to executive leadership and demand that the SOC implement all missing detections.
   • BAccept the SOC's opinion and remove the missed techniques from the report.
   • CRe-run the emulation using only the techniques the SOC considers relevant.
   • DPresent the threat intelligence evidence to the SOC and jointly review the missed techniques to determine if detection improvements are warranted.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An intelligence report describes an adversary that uses a multi-stage attack: initial access via a phishing email, then PowerShell to download a payload, then WMI for lateral movement, and finally scheduled tasks for persistence. The emulation team needs to create a playbook that can be reused and shared. What is the best way to structure the playbook?

   • AUse only commercial C2 frameworks that automatically generate the attack chain.
   • BBreak the playbook into individual modules, each mapped to a MITRE ATT&CK technique, with dependencies between them.
   • CCreate a single monolithic script that executes all steps sequentially.
   • DWrite the playbook in a proprietary format that only the emulation team can understand.
   Reveal Solution Discussion Select an answer first