Adversary Emulation Fundamentals GRTP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the context of adversary emulation, what is the purpose of threat modeling?

   • ATo ensure that all security patches are applied to the organization's systems.
   • BTo create a detailed map of the organization's network infrastructure, including all IP addresses and subnets.
   • CTo identify the most relevant threat actors and the attack paths they are likely to use against the organization.
   • DTo test the organization's security controls by simulating a variety of random attacks.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which statement best describes adversary emulation?

   • AA security assessment that identifies vulnerabilities without attempting to exploit them.
   • BA test that validates the functionality of security tools by running benign traffic through the network.
   • CAn exercise that focuses solely on the physical security of a facility.
   • DA process of mimicking a specific threat actor's tactics, techniques, and procedures to test defensive capabilities.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   During the execution of an adversary emulation, what is the primary consideration when selecting tools and techniques?

   • AThey should be the most sophisticated and complex tools available, regardless of the threat actor.
   • BThey should be the easiest to use to minimize the time required for the engagement.
   • CThey should be chosen to maximize the number of vulnerabilities discovered.
   • DThey should match the tactics, techniques, and procedures of the threat actor being emulated.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary difference between adversary emulation and penetration testing?

   • AAdversary emulation is always performed without any prior knowledge of the target, while penetration testing is always performed with full knowledge.
   • BAdversary emulation is a subset of penetration testing that focuses only on network-level attacks.
   • CAdversary emulation is used only for compliance testing, while penetration testing is used for security improvement.
   • DAdversary emulation is based on a specific threat actor's behavior, while penetration testing focuses on discovering and exploiting vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is planning an adversary emulation exercise. The engagement must not cause any disruption to production systems, and the SOC must not be informed of the exact timing. However, the SOC team needs to know the general scope and the types of activity that will occur. Which element of the rules of engagement (ROE) should be documented to address this?

   • AThe full list of vulnerabilities that will be exploited
   • BThe constraints on allowed techniques and the notification procedures for the SOC
   • CThe names of the individual SOC analysts who will be on shift
   • DThe exact IP addresses and credentials that will be used
   Reveal Solution Discussion Select an answer first