Adversary Emulation Fundamentals GRTP Practice Questions (Page 10)

Questions 46–47

1. 46expert · hard

   During an emulation, the red team discovers that a specific technique they planned to use is blocked by a security control. The threat actor is known to use that technique, but the control is effective against it. The team has limited time and wants to test the SOC's response. What should they do?

   • AUse a completely different technique that is not part of the threat actor's TTPs
   • BReport the block and move on to the next technique without attempting a bypass
   • CAttempt to bypass the control using a variation of the technique that is still aligned with the threat actor's TTPs
   • DStop the emulation because the technique is blocked
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A red team is asked to emulate a specific threat actor for a client. The client has a strict rule: no techniques that could cause data loss. The threat actor is known to use a wiper malware in its final stage. The team has a sandbox environment that fully replicates the production environment. What is the best approach?

   • ASkip the wiper stage entirely because it cannot be emulated safely
   • BRun the actual wiper in the sandbox because it is isolated from production
   • CAsk the client to relax the no-data-loss rule for the sandbox environment
   • DEmulate the wiper's behavior in the sandbox using a non-destructive equivalent and clearly document the deviation
   Reveal Solution Discussion Select an answer first