Adversary Emulation GDAT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How does adversary emulation differ from a typical penetration test?

   • AAdversary emulation replicates a specific threat actor's TTPs, while penetration testing typically identifies and exploits vulnerabilities
   • BAdversary emulation focuses on exploiting vulnerabilities, while penetration testing focuses on mimicking a specific threat actor
   • CAdversary emulation is a purely manual process, while penetration testing is fully automated
   • DAdversary emulation is always performed by external consultants, while penetration testing is always performed by internal staff
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team is asked to validate whether their detection stack can identify a specific intrusion set's post-exploitation behavior. Leadership wants a realistic test that does not require maintaining persistent access or coordinating with external parties. Which approach best fits this requirement?

   • APerform a red team exercise that includes stealthy lateral movement and exfiltration across production systems
   • BConduct a penetration test focused on exploiting a single vulnerability in the internet-facing perimeter
   • CDeploy a honeypot configured to mimic the intrusion set's malware and wait for real attackers
   • DRun an adversary emulation exercise based on the intrusion set's known TTPs in a controlled lab
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of executing an adversary emulation scenario in a controlled environment?

   • ATo test the organization's detection and response capabilities against realistic adversary behavior
   • BTo train employees on how to recognize phishing emails
   • CTo measure the performance of the security team under stress
   • DTo identify all vulnerabilities in the environment that could be exploited by any attacker
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team has completed an emulation exercise and wants to report the results to management. The report should demonstrate the value of the exercise and justify future investment. Which metric is most compelling?

   • AThe number of techniques executed during the exercise
   • BThe number of previously unknown detection gaps identified and subsequently remediated
   • CThe total cost of the exercise
   • DThe number of analysts involved
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is asked to conduct an exercise that mimics a specific threat actor's behavior, but the team is not sure whether to call it adversary emulation or red teaming. The key difference they need to understand is that adversary emulation is more focused on testing specific TTPs, while red teaming is broader. Which scenario best illustrates adversary emulation?

   • AExecuting a predefined set of techniques from a known APT group's profile in a lab to test EDR detection
   • BRunning a vulnerability scan to identify missing patches on critical servers
   • CPerforming a phishing simulation to test user awareness
   • DConducting a full-scope attack simulation that includes social engineering, physical intrusion, and network exploitation
   Reveal Solution Discussion Select an answer first