Adversary Emulation GDAT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During an adversary emulation exercise, the team successfully executed a series of techniques that mimic a specific APT group's lateral movement and data staging behavior. However, the SOC did not generate any alerts for these activities. What is the most likely conclusion about the emulation's outcome?

   • AThe emulation was ineffective because the techniques were not executed correctly
   • BThe emulation was effective because it revealed a detection gap in the SOC's ability to see the emulated TTPs
   • CThe emulation should be stopped because the SOC is not ready for such testing
   • DThe SOC's response was appropriate because no alerts means no threat was present
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team is conducting an adversary emulation exercise and wants to measure how well their SOC can detect and respond to the emulated TTPs. They have defined specific detection use cases and response procedures. What is the most effective way to measure the SOC's performance during the exercise?

   • ATrack which detection use cases fired and measure the time from technique execution to alert generation and response
   • BCount the number of techniques executed during the exercise
   • CReview the threat actor profile to ensure it was accurately replicated
   • DAsk the SOC analysts to rate the difficulty of the exercise
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of the MITRE ATT&CK framework in adversary emulation?

   • ATo provide a knowledge base of adversary tactics and techniques based on real-world observations
   • BTo automate the execution of emulation scenarios without human intervention
   • CTo replace the need for threat intelligence by providing a complete list of all possible attacks
   • DTo provide a scoring system for the severity of vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   During an adversary emulation exercise, the team is using CALDERA to execute a series of techniques. They notice that some techniques are not executing as expected because the environment does not have the necessary dependencies (e.g., PowerShell is disabled). The team needs to adjust the emulation to ensure the techniques run correctly while still testing the SOC's detection. What is the best course of action?

   • AEnable PowerShell in the environment and re-run the original techniques
   • BModify the emulation plan to use alternative techniques that achieve the same objective but are compatible with the environment
   • CSkip the techniques that are not executing and continue with the rest of the emulation
   • DStop the emulation and report that the environment is not suitable for testing
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team is conducting an adversary emulation exercise and has defined success criteria that include detecting at least 90% of the emulated techniques and responding to each within 30 minutes. After the exercise, they find that they detected 85% of techniques and responded to those in an average of 25 minutes. What is the most appropriate conclusion?

   • AThe emulation was fully successful because response time was within the target
   • BThe emulation was unsuccessful because response time was not fast enough
   • CThe emulation results are inconclusive because the success criteria were not well-defined
   • DThe emulation was partially successful because detection did not meet the 90% threshold, but response time was within the 30-minute target
   Reveal Solution Discussion Select an answer first