Define Tactics, Techniques and Procedures and How They Are Regarded in the Industry. SPLK-5001 Practice Questions (Page 4)

Questions 16–17

1. 16foundation · easy

   During incident response, why is it valuable to identify the TTPs used by an attacker?

   • AIt helps responders anticipate the attacker's next likely actions and choose effective containment steps.
   • BIt is only useful for legal proceedings, not for technical response.
   • CIt allows responders to ignore the root cause and focus only on cleanup.
   • DIt guarantees the attacker will not return.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is reviewing an alert that triggered on a suspicious PowerShell command. The analyst determines that the command is a specific implementation of a known technique. Which TTP component does this specific implementation represent?

   • ATactic
   • BIndicator of compromise
   • CProcedure
   • DTechnique
   Reveal Solution Discussion Select an answer first