Adversary Emulation GDAT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team is planning an adversary emulation exercise for a multinational company with strict data residency requirements. The emulation must be conducted in a cloud environment that is compliant with local data protection laws. The team wants to use a framework that supports cloud-based execution and can be configured to run in a specific geographic region. What is the most important consideration when selecting the emulation environment?

   • AEnsure the cloud environment is hosted in a region that meets the data residency requirements and is configured to prevent data from leaving that region
   • BSelect a cloud provider that offers the most powerful compute instances for faster execution
   • CChoose the cheapest cloud region available to minimize costs
   • DUse a cloud environment that is not connected to the internet to ensure security
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company's SOC wants to test its ability to detect a specific ransomware group's behavior, which includes using PowerShell for discovery and scheduled tasks for persistence. They have a segmented lab that mirrors production and a clear set of detection use cases. What is the most appropriate next step to ensure the emulation is both safe and effective?

   • ADisable the EDR in the lab to ensure the techniques execute without interference
   • BAsk the SOC analysts to manually perform the techniques without any documentation or predefined scope
   • CCreate an emulation plan that defines the specific techniques, scope, and success criteria, then execute the techniques in the lab using a framework like CALDERA
   • DRun the ransomware group's known malware samples directly on production systems to see if the EDR catches them
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   After completing an adversary emulation exercise, the security team wants to determine whether their SIEM alerts would have fired on the emulated techniques. Which metric is most relevant?

   • ADetection coverage: the percentage of emulated techniques that triggered an alert
   • BTime to patch vulnerabilities
   • CCost of the emulation exercise
   • DNumber of false positives during the exercise
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is planning an adversary emulation exercise. They want to test their ability to detect a specific threat actor known for using spear-phishing and PowerShell-based lateral movement. The exercise must not disrupt production systems. Which first step is most appropriate?

   • ASelect the threat actor profile and define a scope that includes only non-production systems
   • BRun a full red team exercise without prior planning
   • CImmediately deploy CALDERA agents to all production endpoints
   • DAsk the threat actor to provide their tools
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary metric for assessing the effectiveness of an adversary emulation exercise?

   • AThe total time taken to complete the emulation
   • BThe number of TTPs that were successfully executed without detection
   • CThe number of vulnerabilities discovered during the exercise
   • DThe cost of the exercise compared to the budget
   Reveal Solution Discussion Select an answer first