MITRE ATT&CK Fundamentals

A tactic is the adversary's goal at a stage of an intrusion, such as Credential Access or Exfiltration. A technique is how that goal is achieved. Items often give a behavior and ask for the tactic it serves, so learn the tactic ordering first and attach techniques to each goal.

The framework itself is approachable, but items reward precision: knowing that a procedure is a specific implementation of a technique, and that sub-techniques carry their own IDs. Candidates with SOC or IR exposure usually find scenario questions easier than those memorizing names alone.

It is delivered as multiple-choice items, some framed as short scenarios. The certifying body publishes the current number of items, time limit, delivery options, and scoring on its official site; check there before scheduling rather than relying on secondhand figures.

Retake rules, waiting periods, and any recertification or validity window are set by the certifying organization and change over time. Confirm the current policy on the official site before you book, and note whether renewal requires continuing education or a repeat exam.

Most candidates benefit from several weeks of steady study rather than a cram. Prioritize the enterprise tactic flow and technique structure, then add Mobile and ICS plus the Navigator and STIX material. Build a personal layer mapping techniques you have seen at work; that active recall beats rereading matrix pages.

Start with overview and history so the matrix design makes sense, then enterprise tactics and techniques together, since they reinforce each other. Add software, groups, and campaigns next, then mitigations and data sources. Finish with Mobile, ICS, the data model, and mapping practice.

Common slips include confusing tactics with techniques, treating a tool or malware family as a technique, and ignoring sub-technique granularity. Others miss that mitigations attach to techniques rather than tactics, or cannot name a data source that would detect a given action. Read each stem for the exact question asked.

Recognizing IDs helps fluency, especially T#### and T####.### patterns, but scenario items usually test understanding rather than recall of numbers. Focus on what each technique describes, how it is detected, and which data sources reveal it. Use Navigator layers as a memory aid during study.

They share the tactic-and-technique grammar but cover different platforms and consequences. Mobile tactics reflect device-focused goals such as network-based effects and credential access on phones. ICS tactics address process control and safety-impacting outcomes, so the same behavior can map differently across matrices.

It tests whether you understand ATT&CK as structured data: objects, relationships, and versioning, and how TAXII transports collections. Expect questions on why relationships matter, such as linking a group to a technique through a procedure, and on consuming or sharing machine-readable threat intelligence.