Adversary Emulation GDAT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team is asked to validate whether their new EDR product can detect the specific initial-access and lateral-movement techniques used by a known state-sponsored group that has been targeting their industry. They want to use an open-source framework that maps directly to the MITRE ATT&CK knowledge base and allows them to execute the group's techniques in their isolated lab. Which approach best fits this requirement?

   • AHire an external red team to perform a full-scope attack simulation without predefined rules of engagement
   • BDeploy CALDERA and use its built-in adversary profiles that align with the group's ATT&CK techniques
   • CRun a standard penetration test using Metasploit's default exploit modules against the lab environment
   • DConfigure the EDR to block all known indicators of compromise (IOCs) associated with the group
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   After an adversary emulation exercise, the team wants to produce a report that helps the organization prioritize improvements to its security controls. What is the most useful information to include in the report?

   • AA summary of the threat actor profile used for the emulation
   • BA list of techniques that were not detected, along with the gaps in the current detection use cases
   • CThe names of the SOC analysts who participated in the exercise
   • DThe total number of techniques executed during the exercise
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team is planning an adversary emulation exercise and wants to use a framework that provides a structured way to document and execute TTPs, as well as a common language for sharing results. They also need to be able to map their findings to a widely used knowledge base. Which framework best meets these needs?

   • ACALDERA
   • BNmap
   • CMetasploit
   • DMITRE ATT&CK
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team is using CALDERA to execute an adversary emulation scenario. They have defined a custom adversary profile that includes techniques for credential dumping and lateral movement. During the execution, they want to ensure that the techniques are run in a specific order to mimic the threat actor's behavior. What is the best way to achieve this in CALDERA?

   • AExecute all techniques simultaneously to save time
   • BUse a random order to simulate real-world unpredictability
   • CDefine the techniques in the adversary profile in the desired order, and CALDERA will execute them sequentially
   • DRun each technique manually in a separate terminal session
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   After completing an adversary emulation exercise that replicated a specific APT group's TTPs, the SOC wants to determine whether their detection and response capabilities improved. What is the most effective way to measure the emulation's effectiveness?

   • AReview the emulation report to see if the threat actor profile was accurately replicated
   • BAsk the SOC team if they felt the emulation was realistic
   • CCompare the alerts generated during the emulation to the expected detection use cases and analyze response times for each technique
   • DCount the total number of techniques executed during the emulation
   Reveal Solution Discussion Select an answer first