Adversary Emulation Fundamentals GRTP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   After an adversary emulation exercise, the red team is preparing the final report. The SOC detected some techniques but missed others. The red team also observed that the SOC's response to a detected technique was slow. The company wants to improve both detection and response. Which recommendation should the red team prioritize in the report?

   • ARecommend only detection improvements, since response is less important
   • BRecommend improvements to both detection and response, but prioritize the areas with the most significant gaps
   • CRecommend no improvements, since the exercise was successful
   • DRecommend only response improvements, since detection is already adequate
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services firm wants to validate whether its security operations center (SOC) can detect and respond to a specific threat group that has been observed targeting the banking sector. The engagement must not disrupt production systems, and the SOC will not be told when the activity occurs. Which type of engagement best matches this requirement?

   • AA red team exercise with no predefined scope or rules of engagement
   • BA vulnerability assessment using automated scanners to identify missing patches
   • CA standard penetration test focused on exploiting vulnerabilities in internet-facing systems
   • DAdversary emulation based on the threat group's tactics, techniques, and procedures (TTPs)
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the role of the red team during the execution phase of adversary emulation?

   • ATo monitor the blue team's actions and provide real-time feedback to the organization's management.
   • BTo patch vulnerabilities as soon as they are discovered during the engagement.
   • CTo perform the actions of the emulated threat actor in a controlled manner, following the engagement plan.
   • DTo ensure that the organization's security tools are properly configured before the engagement starts.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which model describes the stages of a cyber attack, from initial reconnaissance to actions on objectives, and is often used to structure adversary emulation planning?

   • AThe Deming Cycle
   • BThe CIA Triad
   • CThe Cyber Kill Chain
   • DThe OSI Model
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   After an adversary emulation exercise, the SOC reports that they detected the initial phishing email but did not detect the subsequent lateral movement. The red team's logs show that the lateral movement technique was executed successfully. Which conclusion is most appropriate?

   • AThe SOC's detection capabilities for lateral movement are weak and need improvement
   • BThe exercise failed because the SOC did not detect all techniques
   • CThe SOC should have detected the lateral movement because it was in the exercise scope
   • DThe red team made a mistake by using a technique that was not detected
   Reveal Solution Discussion Select an answer first