Adversary Emulation Fundamentals GASAE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An emulation team is preparing to test a detection for credential dumping. They plan to use the Mimikatz tool to extract credentials from memory on a lab Windows host. Which MITRE ATT&CK technique ID should they reference in their test plan?

   • AT1003.001 — LSASS Memory
   • BT1041 — Exfiltration Over C2 Channel
   • CT1059.001 — PowerShell
   • DT1547.001 — Registry Run Keys / Startup Folder
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During an adversary emulation, the team needs to execute a technique that involves modifying the Windows registry to establish persistence. The lab environment is a replica of production, and the team wants to avoid leaving any traces that could affect future tests. What is the best practice for executing this technique?

   • ASkip the technique because it is too risky to modify the registry in the lab.
   • BUse a virtual machine snapshot before the technique, and restore the snapshot after the step is complete.
   • CRun the technique on a separate, isolated machine that is not part of the main lab environment.
   • DExecute the registry modification and then manually revert the registry key to its original value.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security team is asked to validate whether their detection stack can identify a specific nation-state actor's known TTPs. The team has a limited budget and cannot disrupt production. They also need to provide evidence to the board that the security controls work. Which approach best balances these constraints?

   • AConduct a full red team exercise against production systems with no advance warning to the SOC.
   • BRun a vulnerability scan against production to identify weaknesses and assume that detections will work.
   • CPerform a focused adversary emulation in a staging environment that mirrors production, using the actor's TTPs and measuring detection coverage.
   • DPurchase a threat intelligence feed and rely on it to block the actor's known indicators.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which tool is commonly used for executing adversary emulation activities?

   • AWireshark
   • BCobalt Strike
   • CSplunk
   • DNessus
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which statement correctly distinguishes adversary emulation from penetration testing?

   • AAdversary emulation focuses on mimicking a specific threat actor's TTPs, while penetration testing focuses on identifying exploitable vulnerabilities.
   • BAdversary emulation is automated, while penetration testing is always manual.
   • CAdversary emulation is only used for compliance, while penetration testing is used for security improvement.
   • DAdversary emulation is performed by external teams, while penetration testing is always internal.
   Reveal Solution Discussion Select an answer first