In the MITRE ATT&CK framework, what is the relationship between tactics and techniques?

Tactics and techniques are interchangeable terms describing the same concept.

Tactics are the procedures, and techniques are the overarching categories.

Tactics are the specific tools used, while techniques are the high-level goals.

Tactics are the 'why' of an attack step, and techniques are the 'how'.

An incident responder is investigating a lateral movement attack. The attacker used a valid administrator account to connect to a file server via SMB and then used a scheduled task to execute a payload. Which MITRE ATT&CK technique is the attacker using for lateral movement?

Exploitation of Remote Services

A security analyst notices that a compromised server is sending HTTP POST requests to a website that hosts a blog. The requests contain encoded data that appears to be commands. Which MITRE ATT&CK technique is the attacker using for command and control?

Standard Application Layer Protocol

Palo Alto NetworksCertified Cybersecurity Practitioner

Domain 1Objective 2

1.2 Categorize Techniques Used by Malicious Actors as Defined by the MITRE ATT&CK Framework CYBERSECURITY-PRACTITIONER Practice Questions (Page 1)

Part of the Cybersecurity domain, which accounts for 19% of the CYBERSECURITY-PRACTITIONER exam.

37questions here

8free pages

13concepts

19%of the exam

13 Concepts in This Objective

MITRE ATT&CK framework overview
Initial Access techniques
Execution techniques
Persistence techniques
Privilege Escalation techniques
Defense Evasion techniques
Credential Access techniques
Discovery techniques
Lateral Movement techniques
Collection techniques
Command and Control techniques
Exfiltration techniques
Impact techniques

Questions 1–5

1foundation · easy
In the MITRE ATT&CK framework, what is the relationship between tactics and techniques?
Select an answer first
2expert · medium
An incident responder is investigating a lateral movement attack. The attacker used a valid administrator account to connect to a file server via SMB and then used a scheduled task to execute a payload. Which MITRE ATT&CK technique is the attacker using for lateral movement?
Select an answer first
3foundation · easy
Which of the following is an example of a Privilege Escalation technique?
Select an answer first
4application · medium
A security analyst notices that a compromised server is sending HTTP POST requests to a website that hosts a blog. The requests contain encoded data that appears to be commands. Which MITRE ATT&CK technique is the attacker using for command and control?
Select an answer first
5foundation · easy
An attacker uses a keylogger to capture usernames and passwords as a user types them. Which MITRE ATT&CK tactic does this activity primarily represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CYBERSECURITY-PRACTITIONER” is a trademark of its owner, used for identification only.

1.2 Categorize Techniques Used by Malicious Actors as Defined by the MITRE ATT&CK Framework CYBERSECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

In the MITRE ATT&CK framework, what is the relationship between tactics and techniques?

An incident responder is investigating a lateral movement attack. The attacker used a valid administrator account to connect to a file server via SMB and then used a scheduled task to execute a payload. Which MITRE ATT&CK technique is the attacker using for lateral movement?

Which of the following is an example of a Privilege Escalation technique?

A security analyst notices that a compromised server is sending HTTP POST requests to a website that hosts a blog. The requests contain encoded data that appears to be commands. Which MITRE ATT&CK technique is the attacker using for command and control?

An attacker uses a keylogger to capture usernames and passwords as a user types them. Which MITRE ATT&CK tactic does this activity primarily represent?

Keep studying — Cybersecurity