Adversary Emulation Fundamentals GASAE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An adversary emulation engagement has concluded. The team documented which techniques were detected and which were missed, and they have a list of recommendations. The security manager wants to ensure the lessons learned lead to lasting improvements. Which action is most important to include in the final report?

   • AA detailed timeline of every command executed during the emulation.
   • BA summary of the tools used and their versions to ensure the emulation can be repeated.
   • CA comparison of the emulation results with the results of the previous year's penetration test.
   • DA prioritized list of detection gaps with specific remediation actions and assigned owners.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company wants to test its defenses against a specific advanced persistent threat (APT) group that has been targeting their industry. They have access to a detailed threat intelligence report describing the group's tools, techniques, and procedures. The emulation team must design an engagement that faithfully represents this group. What is the most important first step?

   • ABegin the emulation immediately to avoid losing time, and adjust based on defender reactions.
   • BAsk the threat intelligence provider to run the emulation on behalf of the company.
   • CPurchase the same commercial tools that the APT group is known to use.
   • DSelect a set of MITRE ATT&CK techniques from the report and translate them into concrete emulation steps.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   During an emulation, the team successfully executed a technique that maps to MITRE ATT&CK T1055 (Process Injection). The SOC's EDR did not alert, but the team later found that the EDR was not configured to monitor the specific process that was injected. What is the most appropriate conclusion?

   • AThe emulation was unsuccessful because the technique did not trigger an alert.
   • BThe SOC should immediately replace the EDR with a different product.
   • CThe technique is undetectable by any EDR product.
   • DThe detection gap is due to a misconfiguration or coverage gap in the EDR, not necessarily a failure of the technique.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An emulation team is executing a scenario that includes credential dumping using Mimikatz. They are running in a controlled lab that mirrors production. The team wants to ensure that the emulation is realistic while also protecting the lab environment from accidental damage. Which practice should they follow?

   • ARun Mimikatz on a domain controller in the lab and allow it to interact with the live domain to observe real-world effects.
   • BRun Mimikatz only on a non-domain-joined workstation to avoid any impact on the domain.
   • CSkip the credential dumping step because it is too risky, and instead simulate the detection by injecting a fake alert.
   • DUse a snapshot of the lab environment before running Mimikatz, and restore the snapshot after the emulation step is complete.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which element is most important to include in the scoping phase of an adversary emulation engagement?

   • AA list of all known vulnerabilities in the environment
   • BA detailed timeline for each emulation step
   • CA list of all employees' names and roles
   • DA clear definition of the systems and networks that are in scope
   Reveal Solution Discussion Select an answer first