Threat Informed Defense GMON Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team has completed an adversary emulation exercise that successfully executed a specific attack chain without triggering any alerts. What should the team do next to improve monitoring?

   • ABlame the security tools and replace them immediately with new vendors.
   • BAnalyze which steps in the attack chain were not detected and create or refine detection rules for those steps.
   • CConclude that the emulation was a failure and stop conducting such exercises.
   • DIgnore the results because the emulation was performed in a test environment.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does adversary emulation directly contribute to improving monitoring capabilities?

   • ABy automatically blocking all simulated attacks before they reach the network
   • BBy reducing the number of security tools needed in the environment
   • CBy providing a list of all vulnerabilities in the environment
   • DBy identifying which detection rules fail to trigger on simulated attack techniques
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team has a detection rule that was created based on adversary emulation results. The rule has a low false positive rate but also a low true positive rate, and analysts are unsure if it is effective. What should the team do as part of the continuous improvement cycle?

   • AIgnore the rule because it is not causing problems.
   • BIncrease the alert threshold to reduce false positives further.
   • CDelete the rule because it is not generating enough alerts.
   • DReview the rule's analytics and compare them with the emulation results to identify why true positives are low, then adjust the rule.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team has access to multiple threat intelligence feeds. Some feeds provide indicators of compromise (IOCs), while others provide detailed reports on adversary TTPs. The team wants to improve their detection capabilities. Which approach best leverages the available intelligence?

   • AUse only the TTP reports and ignore the IOC feeds.
   • BUse only the IOC feeds and ignore the TTP reports.
   • CPrioritize the IOC feeds and create detection rules based on the indicators.
   • DPrioritize the TTP reports and use them to create behavior-based detection rules, while using IOCs for immediate blocking.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team is planning an adversary emulation exercise to test their monitoring capabilities. They have limited time and resources. Which approach best maximizes the value of the exercise?

   • AOnly emulate techniques that are easy to execute to save time.
   • BFocus the emulation on the techniques most likely to be used by adversaries targeting the organization, based on threat intelligence.
   • CSkip the emulation and rely on tabletop exercises instead.
   • DEmulate every technique in the MITRE ATT&CK framework to achieve complete coverage.
   Reveal Solution Discussion Select an answer first