Adversary Emulation Fundamentals GRTP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which framework is commonly used to categorize an adversary's tactics, techniques, and procedures in a structured, knowledge-base format?

   • ATOGAF
   • BMITRE ATT&CK
   • CNIST SP 800-53
   • DISO 27001
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During an adversary emulation exercise, the red team is replicating a threat group that uses a specific remote access tool (RAT) and a particular command-and-control (C2) protocol. The team has deployed the RAT and established C2. Which action best aligns with the emulation plan?

   • ASwitch to a different RAT and C2 protocol to avoid detection
   • BStop the exercise immediately to avoid any risk of detection
   • CContinue executing the next techniques in the emulation plan, such as privilege escalation and lateral movement, using the same RAT and C2 protocol
   • DWait for the SOC to detect the C2 before proceeding
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of evaluating detection and response capabilities during adversary emulation?

   • ATo compare the red team's performance against other red teams.
   • BTo identify gaps in the organization's ability to detect and respond to the emulated threat actor's techniques.
   • CTo determine the exact number of vulnerabilities in the organization's systems.
   • DTo ensure that the red team's tools are working correctly.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does threat intelligence primarily inform adversary emulation planning?

   • AIt provides details about the specific tools, tactics, and procedures used by a threat actor, which the red team can replicate.
   • BIt provides a list of all vulnerabilities in the target environment, so the red team can exploit them.
   • CIt provides the exact IP addresses of the target's servers, so the red team can directly attack them.
   • DIt provides a compliance checklist that the red team must follow during the engagement.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is planning an adversary emulation exercise and has limited budget. The threat intelligence indicates that the threat group has multiple TTPs, but the company wants to focus on the most likely attack path. The red team has identified three potential attack paths, each with different levels of likelihood and impact. Which approach best uses threat modeling to prioritize the exercise?

   • AAsk the SOC which attack path they are most concerned about
   • BChoose the attack path that is easiest to emulate, regardless of likelihood and impact
   • CPrioritize the attack path with the highest likelihood and impact, and scope the exercise to that path
   • DEmulate all three attack paths equally, regardless of likelihood and impact
   Reveal Solution Discussion Select an answer first