Integrate Intelligence-Informed Advanced Adversary Emulation and Threat Modeling. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–17

1. 16expert · hard

   A security team is planning an adversary emulation exercise. They have access to a threat intelligence feed that provides IOCs and TTPs for a specific threat group. The team wants to ensure the exercise is realistic and relevant. However, the team has limited time and resources. They need to balance the need for realism with the need to complete the exercise within a reasonable timeframe. What is the most effective way to use the intelligence to design the emulation?

   • AUse the IOCs to create detection rules and block known malicious indicators.
   • BPrioritize the TTPs based on the organization's risk and the threat group's likelihood of using them, and design emulation steps for the highest-priority TTPs.
   • CUse all TTPs from the intelligence feed to create a comprehensive emulation plan.
   • DUse the TTPs from the intelligence feed to create a threat model, but do not execute the emulation.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of adversary emulation in a cybersecurity defense program?

   • ATo simulate the behavior of a specific threat actor to test and improve defensive capabilities
   • BTo replace the need for penetration testing in an organization
   • CTo satisfy compliance requirements by generating a report of simulated attacks
   • DTo automatically block all known malicious IP addresses at the perimeter
   Reveal Solution Discussion Select an answer first