Adversary Emulation Fundamentals GRTP Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An organization wants to emulate a financially motivated threat group that has been observed using commodity malware and phishing. The team has limited time and budget. They need to prioritize which techniques to emulate. Which input should drive the selection of techniques?

   • AThe most complex techniques from MITRE ATT&CK to challenge the detection team
   • BThe techniques that are easiest to execute with available open-source tools
   • CThe techniques most commonly used by all threat groups in the MITRE ATT&CK database
   • DThe specific TTPs and tools attributed to that threat group in threat intelligence reports
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An organization wants to run an adversary emulation to test its incident response process. The legal team requires that the emulation not involve any real customer data. The emulation team has access to a test environment with synthetic data. However, the threat actor being emulated is known to target customer databases. What is the best way to handle this constraint?

   • AEmulate the techniques used to access the customer database in the test environment using synthetic data
   • BEmulate only the initial access techniques and skip the database access stage
   • CCancel the emulation because the constraint makes it impossible to emulate the threat actor
   • DUse real customer data but anonymize it before the exercise
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company is planning an adversary emulation exercise and has collected threat intelligence indicating that a specific threat group uses spear-phishing with malicious Office documents, then uses PowerShell to download additional tools, and finally exfiltrates data via HTTPS. The company wants to test its defenses against this specific behavior. Which approach best uses this threat intelligence?

   • AFocus only on the final exfiltration stage, since that is the most critical
   • BUse a generic set of TTPs that are common across many threat groups
   • CRun the exercise without any predefined TTPs to avoid bias
   • DDesign the emulation to replicate the exact TTPs, including the spear-phishing vector and PowerShell usage
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   An emulation exercise is complete. The blue team detected 80% of the techniques, but the missed 20% included a critical privilege escalation technique. The organization has limited budget for security improvements. What should be the priority?

   • AInvest in detection for the missed privilege escalation technique first
   • BRerun the exercise to confirm the missed technique is consistently missed
   • CAccept the 80% detection rate as sufficient and make no changes
   • DImprove detection for all techniques equally to raise the overall detection rate
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An organization is scoping an adversary emulation exercise. The executive team wants to test the effectiveness of the security operations center (SOC) without causing downtime. Which constraint should be included in the rules of engagement?

   • AAllow the emulation team to use any technique, including destructive ones
   • BProhibit techniques that could impact production systems and require immediate stop on any sign of disruption
   • CLimit the emulation to passive reconnaissance only
   • DRequire the emulation team to inform the SOC before each technique is executed
   Reveal Solution Discussion Select an answer first