Integrate Intelligence-Informed Advanced Adversary Emulation and Threat Modeling. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is building an adversary emulation plan based on a threat intelligence report about a ransomware group. The report includes file hashes, domain names, and specific MITRE ATT&CK techniques. The team wants to ensure the emulation is realistic and tests their defenses against this specific group. What is the most effective way to use this intelligence?

   • AIncorporate the techniques from the report into the emulation steps, while using the IOCs as validation that the emulation is realistic.
   • BCreate a threat model of the organization's assets and map the IOCs to the assets they might target.
   • CShare the IOCs with all security staff and ask them to manually search for these indicators in their logs.
   • DUse the file hashes and domains as indicators of compromise (IOCs) to block them in the firewall and EDR.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of defining rules of engagement (ROE) for an adversary emulation exercise?

   • ATo specify the boundaries and constraints of the emulation to prevent unintended damage
   • BTo guarantee the emulation will succeed in compromising the target
   • CTo provide a legal waiver for all actions taken during the exercise
   • DTo ensure the emulation is performed without any monitoring
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After an adversary emulation exercise, a security team has collected logs from their SIEM, EDR, and network monitoring tools. They want to translate the findings into actionable defensive improvements. What should they do first?

   • AShare the raw logs with all security analysts for manual review.
   • BImmediately implement new detection rules for all techniques that were missed.
   • CAnalyze the logs to identify which adversary techniques were detected, missed, or detected with delay.
   • DUpdate the threat model to reflect the techniques that were successfully detected and those that were missed.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team is planning an adversary emulation exercise to test their detection of a specific threat group known for using living-off-the-land binaries and PowerShell. They have access to a commercial threat intelligence feed that provides detailed TTPs and IOCs for this group. The team wants to ensure the exercise is realistic and relevant. What should they do first?

   • ADeploy additional endpoint detection and response (EDR) sensors to increase visibility during the exercise.
   • BReview the organization's firewall rules to ensure they block known command-and-control (C2) domains from the intelligence feed.
   • CMap the threat group's TTPs to the MITRE ATT&CK framework and design emulation steps that replicate those techniques.
   • DRun a vulnerability scan on all internal systems to identify weaknesses that the threat group could exploit.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a key element to define when scoping an adversary emulation exercise?

   • AThe personal preferences of the emulation team
   • BThe specific systems and networks that are in scope for the exercise
   • CThe number of security alerts generated during the exercise
   • DThe brand of tools used by the emulation team
   Reveal Solution Discussion Select an answer first