Adversary Emulation Fundamentals GRTP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   After an adversary emulation, the red team and blue team disagree on the interpretation of a finding. The red team claims a technique was detected, while the blue team says it was not because the alert was not escalated. The organization wants to improve its security posture. What is the best way to resolve this?

   • ARemove the finding from the report to avoid conflict
   • BDefine clear criteria for what constitutes a detection and apply them consistently to the exercise logs
   • CAccept the red team's interpretation because they executed the technique
   • DAccept the blue team's interpretation because they are responsible for detection
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During an adversary emulation, the team needs to execute a series of techniques that mimic a specific threat group's lateral movement. They have a list of MITRE ATT&CK technique IDs. What is the most effective way to ensure the emulation stays aligned with the threat group's behavior?

   • ARandomly select techniques from the ATT&CK matrix to avoid predictability
   • BMap each technique to the corresponding ATT&CK procedure and execute them in the sequence described by the threat report
   • CExecute the techniques in any order that is convenient for the team
   • DUse only the techniques that are easiest to automate with existing scripts
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which metric is most useful for evaluating the effectiveness of detection capabilities during an adversary emulation?

   • AThe number of vulnerabilities found by the red team.
   • BThe total cost of the engagement.
   • CThe time it takes for the blue team to detect the red team's activities.
   • DThe number of tools used by the red team.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   After an adversary emulation exercise, the red team has produced a detailed report with findings and recommendations. The SOC team disagrees with some of the findings, claiming that the red team's techniques were not realistic. The red team used techniques that were mapped to the emulated threat group's TTPs. What should the red team do to resolve this disagreement?

   • AModify the report to remove the disputed findings to avoid conflict
   • BReview the findings with the SOC, providing evidence that the techniques were based on threat intelligence and mapped to the emulated threat's TTPs
   • CEscalate the disagreement to senior management without discussion
   • DIgnore the SOC's concerns because the red team is the expert
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is planning an adversary emulation exercise and wants to ensure that the exercise does not cause any service outages. The red team has proposed using a technique that could potentially disrupt a critical database. What should the red team do?

   • AAsk the SOC to monitor the database during the exercise
   • BModify the technique to avoid the disruptive impact, or exclude it from the exercise and document the decision
   • CProceed with the technique because it is part of the emulated threat's TTPs
   • DUse the technique but only during off-peak hours
   Reveal Solution Discussion Select an answer first