A security team is planning an adversary emulation exercise for a critical financial application. The exercise must not cause any downtime, but it must also test the SOC's ability to detect and respond to a specific APT's data exfiltration techniques. The team has a limited time window and must use a framework that allows for precise control over the techniques executed. What is the best approach to balance these constraints?

Use a full red team exercise that includes all possible attack vectors to ensure comprehensive coverage

Skip the emulation and rely on the SOC's past experience with similar threats

Use CALDERA in a segmented lab environment that mirrors the application, and execute only the data exfiltration techniques from the APT's profile

Run the emulation directly on the production application but only during off-peak hours

A company wants to test its defenses against a specific threat actor's known behavior, but they are concerned about the cost and disruption of a full red team exercise. They want a more focused approach that uses a framework to execute the actor's TTPs in a controlled environment. Which activity best matches this requirement?

A full red team exercise that includes social engineering and physical intrusion attempts

Adversary emulation using a framework like CALDERA to replicate the actor's specific techniques

A penetration test that focuses on exploiting a single critical vulnerability

A vulnerability scan of the network to identify missing patches

When planning an adversary emulation exercise, what is the primary reason for selecting a specific threat actor profile?

To align the emulation with the organization's actual threat landscape and priorities

To satisfy regulatory requirements for annual security testing

To minimize the need for security monitoring during the exercise

To ensure the emulation uses the most complex techniques available

A security manager wants to run an adversary emulation exercise to test the organization's response to a ransomware actor. The exercise must be completed within two weeks and cannot involve external consultants. Which planning decision is most appropriate?

Attempt to emulate every technique in MITRE ATT&CK

Hire external consultants to run the exercise

Define a narrow scope focusing on the ransomware actor's initial access and encryption techniques

Skip planning and start executing immediately

GIAC Defending Advanced Threats

Domain 4Objective 2

Adversary Emulation GDAT Practice Questions (Page 7)

Part of the Exfiltration and Emulation domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 5–8 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 31–35

31expert · hard
A security team is planning an adversary emulation exercise for a critical financial application. The exercise must not cause any downtime, but it must also test the SOC's ability to detect and respond to a specific APT's data exfiltration techniques. The team has a limited time window and must use a framework that allows for precise control over the techniques executed. What is the best approach to balance these constraints?
Select an answer first
32application · medium
A company wants to test its defenses against a specific threat actor's known behavior, but they are concerned about the cost and disruption of a full red team exercise. They want a more focused approach that uses a framework to execute the actor's TTPs in a controlled environment. Which activity best matches this requirement?
Select an answer first
33application · medium
A team wants to use a framework that provides a common language for describing adversary behaviors and also offers a structured way to plan emulation scenarios. Which framework is best suited?
Select an answer first
34foundation · easy
When planning an adversary emulation exercise, what is the primary reason for selecting a specific threat actor profile?
Select an answer first
35application · medium
A security manager wants to run an adversary emulation exercise to test the organization's response to a ransomware actor. The exercise must be completed within two weeks and cannot involve external consultants. Which planning decision is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Adversary Emulation GDAT Practice Questions (Page 7)

Questions 31–35

A team wants to use a framework that provides a common language for describing adversary behaviors and also offers a structured way to plan emulation scenarios. Which framework is best suited?

When planning an adversary emulation exercise, what is the primary reason for selecting a specific threat actor profile?

A security manager wants to run an adversary emulation exercise to test the organization's response to a ransomware actor. The exercise must be completed within two weeks and cannot involve external consultants. Which planning decision is most appropriate?

Keep studying — Exfiltration and Emulation