Adversary Emulation Fundamentals GRTP Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary purpose of the final report in an adversary emulation engagement?

   • ATo communicate the findings, including the effectiveness of defenses and recommendations for improvement.
   • BTo justify the cost of the engagement to the organization's leadership.
   • CTo provide a detailed log of every command executed by the red team.
   • DTo assign blame to specific individuals or teams for security failures.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A threat intelligence report describes a group that uses living-off-the-land binaries (LOLBins) and PowerShell for most of its operations. The organization's SOC has strong endpoint detection but weak logging for PowerShell. The emulation team has limited time. What should they prioritize?

   • AEmulate the LOLBin and PowerShell techniques to highlight the logging gap
   • BFocus on network-based techniques instead because they are easier to emulate
   • CSpend time improving PowerShell logging before starting the emulation
   • DEmulate only the techniques that the SOC is likely to detect to avoid embarrassment
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   During an adversary emulation exercise, the red team is using a technique that is mapped to the emulated threat group's TTPs. However, the technique is not working as expected because the target environment has a security control that blocks the technique. The red team has identified an alternative technique that is not in the emulated threat's TTPs but would achieve the same objective. What should the red team do?

   • AAsk the SOC to disable the security control
   • BUse the original technique repeatedly until it works
   • CUse the alternative technique and document the deviation from the emulated threat's TTPs
   • DStop the exercise because the exact technique cannot be used
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security team is planning an adversary emulation exercise and wants to structure the engagement around the stages an attacker would progress through, from initial access to exfiltration. They also want to ensure that each stage is mapped to known adversary behavior. Which framework combination would best support this planning?

   • AMITRE ATT&CK alone, because it already includes the full kill chain stages
   • BMITRE ATT&CK for technique-level mapping and the Cyber Kill Chain for the high-level stages
   • CThe Cyber Kill Chain alone, because it provides both stages and specific techniques
   • DThe Diamond Model alone, because it focuses on adversary infrastructure
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is planning an adversary emulation engagement. The legal team requires that the exercise not disrupt production systems and that all activities be approved in writing. Which document should the team create first?

   • AA lessons-learned document from a previous exercise
   • BA rules of engagement (ROE) document outlining scope, authorization, and constraints
   • CA threat intelligence report on the emulated actor
   • DA detailed penetration test report
   Reveal Solution Discussion Select an answer first