Adversary Emulation Fundamentals GRTP Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A red team is executing an adversary emulation exercise. The emulation plan includes a technique that requires the use of a specific exploit, but the exploit is known to be unstable and could crash the target system. The ROE explicitly prohibits causing service outages. The red team has a backup technique that is less likely to cause disruption but is not as closely aligned with the emulated threat's TTPs. What should the red team do?

   • AUse the backup technique and document the deviation from the emulated threat's TTPs
   • BUse the unstable exploit because it is more aligned with the threat's TTPs
   • CCancel the exercise because the exact technique cannot be used
   • DAsk the SOC for permission to use the unstable exploit
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An adversary emulation exercise revealed that the SOC missed several techniques because they were not covered by existing detection rules. The team wants to ensure these lessons are incorporated into future operations. What should they do?

   • ARerun the same exercise immediately to see if the SOC performs better
   • BDocument the missed techniques and create a plan to develop and test new detection rules
   • CKeep the findings confidential to avoid embarrassing the SOC team
   • DBlame the SOC team for the missed detections in the final report
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   After running an adversary emulation exercise, the blue team reports that they detected several techniques but missed others. The organization wants to improve its detection capabilities. What should the team do next?

   • AReview the missed techniques and update detection rules and monitoring coverage accordingly
   • BImmediately rerun the exercise with more aggressive techniques
   • CDisable the detection tools that generated false positives
   • DFocus only on the techniques that were detected to reinforce existing strengths
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is a critical step in the planning phase of an adversary emulation engagement?

   • AImmediately launching attacks to test the organization's defenses.
   • BPurchasing new security tools for the organization.
   • CDeleting all logs to avoid detection.
   • DDefining clear objectives and success criteria for the engagement.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security team is asked to validate whether their detection stack can identify a specific threat group's lateral movement techniques. They have a detailed threat report describing the group's tools and TTPs. The team wants to run a controlled exercise that mimics this group's behavior as closely as possible without causing business disruption. Which approach best fits this requirement?

   • ADeploy a honeypot to capture the threat group's actual attack traffic
   • BConduct a penetration test focused on exploiting vulnerabilities in internet-facing systems
   • CPerform an adversary emulation exercise using MITRE ATT&CK techniques aligned with the threat report
   • DRun a red team exercise with no predefined rules of engagement to maximize realism
   Reveal Solution Discussion Select an answer first