Adversary Emulation Fundamentals GASAE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An organization is planning an adversary emulation engagement. The legal team requires that the engagement not affect production systems, and the security operations center (SOC) wants to validate its detection of lateral movement techniques. Which scoping decision best satisfies both requirements?

   • ARun the emulation on production systems but only during off-peak hours.
   • BRun the emulation in a production-like lab environment and restrict lateral movement techniques to that lab.
   • CAsk the SOC to simulate lateral movement using tabletop exercises instead of live emulation.
   • DUse only passive techniques that do not generate any network traffic.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   After executing an adversary emulation that included PowerShell download cradle, scheduled task persistence, and HTTPS exfiltration, the security team reviews the SIEM alerts. They find that the download cradle and exfiltration generated alerts, but the scheduled task persistence did not. What is the most appropriate next step?

   • ARemove the scheduled task technique from the emulation plan because it is not detected.
   • BRe-run the entire emulation to see if the alert appears on a second attempt.
   • CInvestigate why the scheduled task creation was not detected, and then create or tune a detection rule for that technique.
   • DConclude that the persistence technique is not a risk because the other two steps were detected.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A threat intelligence report describes an adversary that uses a specific phishing lure, then exploits a known vulnerability in a web server, and finally uses a custom backdoor for persistence. The emulation team wants to build a realistic scenario. Which source of information is most important to incorporate into the emulation plan?

   • AThe MITRE ATT&CK framework to map the adversary's techniques to tactics.
   • BThe detailed TTPs described in the report, including the phishing lure, the vulnerability exploited, and the backdoor's behavior.
   • CThe victimology section of the report, which describes the types of organizations targeted.
   • DThe specific indicators of compromise (IoCs) listed in the report, such as file hashes and domains.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of defining rules of engagement (ROE) in an adversary emulation engagement?

   • ATo ensure the emulation is as realistic as possible
   • BTo establish boundaries and constraints for the emulation activities
   • CTo automate the execution of emulation steps
   • DTo document the findings from the emulation
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team is planning an adversary emulation based on a threat report that describes an adversary using a previously unknown technique for privilege escalation. The team has a limited budget and must decide whether to include this technique in the emulation. The technique is not yet mapped in MITRE ATT&CK. What is the best course of action?

   • AWait until MITRE ATT&CK updates to include the technique before running the emulation.
   • BInclude the technique in the emulation and map it to the closest existing ATT&CK technique, noting the discrepancy.
   • CInclude the technique but do not map it to any ATT&CK technique to avoid confusion.
   • DExclude the technique because it is not in MITRE ATT&CK, and focus only on known techniques.
   Reveal Solution Discussion Select an answer first