Adversary Emulation GDAT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What should be assessed to measure the response capability during an adversary emulation?

   • AThe number of security tools deployed in the environment
   • BThe level of encryption used on the network
   • CThe speed and accuracy of the security team's response to detected TTPs
   • DThe number of employees who are aware of the exercise
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company wants to run an adversary emulation exercise to test its defenses against a specific threat actor. They have a limited budget and want to minimize disruption to their production environment. They also need to ensure the exercise is repeatable and measurable. What is the most important factor to define during the planning phase?

   • AThe specific threat actor profile and the scope of the emulation, including which systems and techniques will be used
   • BThe brand of the EDR solution used in the production environment
   • CThe type of vulnerability scanner to use during the exercise
   • DThe number of security analysts available to observe the exercise
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which element is most important to define when scoping an adversary emulation exercise?

   • AThe number of team members participating in the exercise
   • BThe budget allocated for the exercise
   • CThe specific systems and networks that are in scope for the exercise
   • DThe brand of security tools used by the organization
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is evaluating different adversary emulation frameworks for a large organization with a mature security operations center. They need a framework that can integrate with their existing SIEM and SOAR tools, support custom threat actor profiles, and provide detailed reporting for compliance purposes. Which framework is most likely to meet these requirements?

   • AMetasploit, because it has a large library of exploits
   • BCALDERA, because it is open-source and can be extended with plugins for SIEM/SOAR integration
   • CAtomic Red Team, because it is simple to use and maps to ATT&CK
   • DMITRE ATT&CK, because it is the industry standard for threat intelligence
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is planning an adversary emulation exercise and needs to select a threat actor profile. They want to focus on a group that is known to target their industry and uses techniques that are relevant to their environment. What is the most important factor to consider when selecting the threat actor profile?

   • AThe threat actor should be the most sophisticated group available
   • BThe threat actor's techniques should be relevant to the organization's environment and industry
   • CThe threat actor should be the most recently active group
   • DThe threat actor should have the most publicly available information
   Reveal Solution Discussion Select an answer first