Why is it important to execute emulation scenarios in a controlled environment?

To make the emulation more challenging for the security team

To allow the use of real malware without any restrictions

To reduce the need for monitoring during the exercise

To ensure that the emulation does not cause unintended damage to production systems

An organization is planning an emulation exercise to test its defenses against a nation-state actor. The exercise must be realistic, but the organization cannot afford to have any production systems impacted. The team has a limited budget. Which approach best meets these requirements?

Run the emulation in production but only during off-hours

Use a cloud-based environment that is not isolated from the corporate network

Build a dedicated lab that mirrors production and emulate the actor's TTPs there

Emulate only a few techniques to save money

Which statement best describes the primary purpose of adversary emulation?

To demonstrate the business impact of a successful breach by exploiting a chain of vulnerabilities

To simulate the specific tactics, techniques, and procedures of a known threat actor to test detection and response

To identify as many vulnerabilities as possible across an organization's attack surface

To validate that security controls are configured correctly against known compliance standards

A security analyst is executing an emulation scenario that includes credential dumping and lateral movement. The scenario is based on a MITRE ATT&CK technique. Which action best aligns with the emulation methodology?

Skip the credential dumping step to avoid detection

Use a known tool that implements the technique, such as Mimikatz for credential dumping, in a controlled lab

Use a custom tool that has never been seen in the wild

Execute the technique on production systems to test real-world impact

GIAC Defending Advanced Threats

Domain 4Objective 2

Adversary Emulation GDAT Practice Questions (Page 1)

Part of the Exfiltration and Emulation domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 5–8 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 1–5

1foundation · easy
Why is it important to execute emulation scenarios in a controlled environment?
Select an answer first
2expert · hard
An organization is planning an emulation exercise to test its defenses against a nation-state actor. The exercise must be realistic, but the organization cannot afford to have any production systems impacted. The team has a limited budget. Which approach best meets these requirements?
Select an answer first
3foundation · easy
Which statement best describes the primary purpose of adversary emulation?
Select an answer first
4foundation · easy
Which tool is specifically designed to automate the execution of adversary emulation plans using a plugin-based architecture?
Select an answer first
5application · medium
A security analyst is executing an emulation scenario that includes credential dumping and lateral movement. The scenario is based on a MITRE ATT&CK technique. Which action best aligns with the emulation methodology?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.