Adversary Emulation Fundamentals GRTP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of defining rules of engagement (ROE) in an adversary emulation engagement?

   • ATo guarantee that the red team will successfully compromise the target systems.
   • BTo establish the boundaries and constraints for the red team's actions, including what is allowed and what is off-limits.
   • CTo document the final report structure and the format for presenting findings.
   • DTo provide a detailed list of vulnerabilities that the red team should exploit.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During an emulation, the red team needs to deploy a tool that mimics the command and control (C2) communication of a specific malware family. The team has a sandbox environment that replicates the production network. What should they do to ensure the emulation is effective?

   • ADeploy an open-source C2 framework configured to match the malware's network signatures
   • BRun the emulation directly in the production environment to get accurate results
   • CSkip C2 emulation because it is too complex to replicate
   • DUse the actual malware sample in the sandbox to ensure perfect fidelity
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company wants to emulate a threat actor that is known to target the energy sector. The team has limited intelligence about the actor's specific tools but knows their preferred entry points and objectives. How should the team approach the emulation?

   • AUse a generic set of techniques from the MITRE ATT&CK framework without tailoring
   • BFocus on the known entry points and objectives, and select techniques that align with those behaviors
   • CSkip the emulation because the intelligence is insufficient
   • DEmulate a different, better-documented threat actor instead
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   After completing an adversary emulation exercise, the red team has compiled a list of findings, including which techniques were detected, which were missed, and the overall effectiveness of the SOC. What is the most important next step to ensure the exercise leads to improvement?

   • AConduct a lessons-learned meeting with the SOC and other stakeholders to discuss the findings and create an action plan
   • BArchive the report and move on to the next project
   • CPublish the findings on the company's internal wiki for everyone to read
   • DImmediately implement all recommended changes without further discussion
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How should lessons learned from an adversary emulation exercise be incorporated into an organization's security program?

   • ABy updating detection rules, incident response procedures, and security controls based on the findings.
   • BBy immediately launching another emulation exercise to validate the findings.
   • CBy archiving the report and not taking any further action.
   • DBy sharing the report only with the red team for their own improvement.
   Reveal Solution Discussion Select an answer first