I85PREP
⌘ K
MITRE ATT&CK Fundamentals study materials
MITRE ATT&CK Fundamentals study resources

MITRE ATT&CK Fundamentals practice questions

One question at a time. Build your MITRE ATT&CK Fundamentals understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ATT&CK Overview and History

Which organization created and maintains the MITRE ATT&CK knowledge base?

  1. FIRST
  2. NIST
  3. SANS Institute
  4. MITRE Correct answer.

Explanation

ATT&CK was developed and is maintained by MITRE, a not-for-profit organization that operates federally funded research and development centers. MITRE publishes the framework and curates community contributions to it. NIST, SANS, and FIRST are separate organizations with their own security frameworks and programs.

Question 2ATT&CK Overview and History

The ATT&CK matrix is primarily organized around which central concept?

  1. Network protocol layers
  2. Compliance control families
  3. Software vulnerability classes
  4. Adversary tactics and techniques Correct answer.

Explanation

ATT&CK is structured as a matrix whose columns are tactics, representing adversary goals, and whose rows contain techniques that accomplish those goals. This structure lets defenders map observed behavior to a common vocabulary. Control families, vulnerability classes, and protocol layers belong to other frameworks.

Question 3ATT&CK Overview and History

In ATT&CK terminology, what does a tactic represent?

  1. A signature used by endpoint detection software
  2. The adversary's tactical goal or reason for performing an action Correct answer.
  3. A vulnerability that an adversary exploits
  4. A specific tool an adversary installs on a host

Explanation

A tactic is the adversary's goal, the 'why' behind an action, such as persistence or credential access. Techniques describe the 'how' used to achieve that goal. Tools, detection signatures, and vulnerabilities are separate concepts that may appear in technique descriptions but are not tactics.

Question 4ATT&CK Overview and History

Which statement best describes the relationship between a technique and a sub-technique in ATT&CK?

  1. A sub-technique is a more specific implementation of a parent technique Correct answer.
  2. A sub-technique is an alternative name for a software entry
  3. A sub-technique is a deprecated technique replaced by a newer one
  4. A sub-technique is a defensive countermeasure mapped to a technique

Explanation

Sub-techniques were introduced to add granularity beneath broad parent techniques, capturing specific ways a technique is carried out while preserving a stable parent identifier. They share the parent's tactic context but carry their own identifier such as T1059.001. Deprecation, countermeasures, and software entries are handled elsewhere in the framework.

Question 5ATT&CK Overview and History

Which ATT&CK technology domain focuses on adversary behavior against cloud infrastructure such as SaaS and IaaS environments?

  1. ATT&CK for Enterprise
  2. ATT&CK for Cloud Correct answer.
  3. ATT&CK for ICS
  4. ATT&CK for Mobile

Explanation

ATT&CK for Cloud, sometimes presented as a set of matrices within the enterprise ecosystem, addresses cloud platforms including SaaS, IaaS, and Office 365. The Mobile, ICS, and Enterprise domains target different environments. Each domain has its own tactics and techniques suited to that environment.

Question 6ATT&CK Overview and History

Which ATT&CK domain would be most appropriate for analyzing adversary behavior against programmable logic controllers on a factory floor?

  1. ATT&CK for ICS Correct answer.
  2. ATT&CK for Enterprise
  3. ATT&CK for Mobile
  4. ATT&CK for Cloud

Explanation

ATT&CK for ICS was built for industrial control systems, including PLCs, RTUs, and associated operational technology. Its tactics and techniques reflect the safety and availability concerns of that environment. Mobile, Cloud, and Enterprise domains do not model industrial control behavior.

Question 7ATT&CK Overview and History

Which ATT&CK platform originally served as the foundation from which the framework expanded?

  1. Linux
  2. macOS
  3. Android
  4. Windows Correct answer.

Explanation

ATT&CK began with a focus on Windows enterprise environments, reflecting the dominant target of the adversaries being studied at the time. Coverage later expanded to macOS, Linux, cloud, mobile, and ICS. Android, macOS, and Linux were added as the framework matured.

Question 8ATT&CK Overview and History

What is the primary defensive purpose of ATT&CK as described by its maintainers?

  1. To certify that an organization meets a regulatory compliance standard
  2. To serve as a common knowledge base of adversary behavior for detection and assessment Correct answer.
  3. To rank vulnerabilities by exploitability for patch prioritization
  4. To provide a checklist that guarantees prevention of intrusions

Explanation

ATT&CK was created to document real-world adversary behavior in a structured, shared vocabulary so defenders can improve detection, threat assessment, and defensive coverage. It is descriptive rather than prescriptive and does not certify compliance or guarantee prevention. Vulnerability ranking is the role of systems such as CVSS.

Question 9ATT&CK Overview and History

An analyst wants to describe an adversary's use of PowerShell to execute commands. Which ATT&CK element best captures this specific behavior?

  1. A software entry for PowerShell
  2. A tactic named Execution
  3. A sub-technique under Command and Scripting Interpreter Correct answer.
  4. A mitigation named Execution Prevention

Explanation

PowerShell execution is modeled as a sub-technique beneath the parent technique Command and Scripting Interpreter, giving it a precise identifier. The tactic Execution is the broader goal that contains many techniques. Software and mitigation entries describe tools and defenses rather than the behavior itself.

Question 10ATT&CK Overview and History

Which ATT&CK tactic covers adversaries attempting to maintain a foothold across restarts and credential changes?

  1. Exfiltration
  2. Discovery
  3. Collection
  4. Persistence Correct answer.

Explanation

Persistence is the tactic describing techniques that let adversaries keep access despite restarts, credential changes, or other interruptions. Discovery concerns learning about the environment, Collection concerns gathering data, and Exfiltration concerns stealing it. Each tactic names a distinct adversary goal.

Question 11ATT&CK Overview and History

Which ATT&CK tactic is positioned earliest in the enterprise matrix and covers techniques such as spearphishing and drive-by compromise?

  1. Lateral Movement
  2. Initial Access Correct answer.
  3. Execution
  4. Privilege Escalation

Explanation

Initial Access describes techniques for gaining an entry point into a network, including phishing and drive-by compromise. Execution, Privilege Escalation, and Lateral Movement occur at later stages of an intrusion. The matrix orders tactics roughly along the adversary lifecycle.

Question 12ATT&CK Overview and History

A defender maps observed adversary behavior to ATT&CK and finds several techniques with no corresponding detection coverage. What does this mapping most directly help the defender do?

  1. Prove that the organization is fully compliant with regulations
  2. Calculate the CVSS score of the exploited vulnerability
  3. Identify gaps in detection coverage for prioritization Correct answer.
  4. Determine the exact identity of the adversary group

Explanation

Mapping behavior to ATT&CK techniques lets defenders compare observed or expected behaviors against existing detections to reveal coverage gaps. It does not establish compliance, attribute attacks to a specific group with certainty, or compute vulnerability scores. The output is a prioritized view of where defensive investment is needed.

Question 13ATT&CK Overview and History

In ATT&CK, what does a Group entry represent?

  1. A group of techniques that share the same tactic
  2. A team of defenders assigned to monitor the enterprise
  3. A category of malware sharing a common codebase
  4. A cluster of activity assessed to be associated with a single adversary organization Correct answer.

Explanation

Group entries describe intrusion sets or threat actors whose activity is assessed to be associated with one adversary organization, and they list the techniques and software attributed to that group. They are not defensive teams, malware families, or tactic groupings. Software entries are separate and represent tools and malware.

Question 14ATT&CK Overview and History

What distinguishes a Software entry in ATT&CK from a Group entry?

  1. Software describes a defensive product, while a Group describes a penetration testing team
  2. Software describes a technique category, while a Group describes a tactic
  3. Software describes a vulnerability, while a Group describes a patch
  4. Software describes a tool or malware used by adversaries, while a Group describes an attributed adversary organization Correct answer.

Explanation

Software entries catalog tools and malware families and list the techniques they implement, while Group entries describe attributed adversary organizations and reference the software they use. The two are linked but represent different things. Neither describes defensive products, tactics, or vulnerabilities.

Question 15ATT&CK Overview and History

Which ATT&CK element provides defensive recommendations intended to prevent or reduce the impact of a technique?

  1. Campaigns
  2. Procedures
  3. Mitigations Correct answer.
  4. Data Sources

Explanation

Mitigations are ATT&CK entries that describe defensive measures mapped to the techniques they can address. Procedures describe specific adversary implementations, Data Sources describe where detection evidence can be collected, and Campaigns describe a grouping of activity over a time period. Only Mitigations are the defensive recommendations.

Question 16ATT&CK Overview and History

In ATT&CK, what is a Procedure?

  1. A scoring method for ranking technique severity
  2. A specific implementation or in-the-wild example of a technique Correct answer.
  3. A formal defensive playbook for incident response
  4. A timeline of tactics followed in order by every adversary

Explanation

A procedure is the specific way an adversary implements a technique, often illustrated with real-world examples and referenced tools. It sits beneath the technique in the abstraction hierarchy of tactic, technique, and procedure. Defensive playbooks, fixed timelines, and severity scoring are not what procedures describe.

Question 17ATT&CK Overview and History

What is the correct abstraction hierarchy that ATT&CK uses to describe adversary behavior, from most general to most specific?

  1. Procedure, tactic, technique
  2. Procedure, technique, tactic
  3. Technique, tactic, procedure
  4. Tactic, technique, procedure Correct answer.

Explanation

ATT&CK moves from the general goal, the tactic, to the technique used to achieve it, and then to the procedure, the specific implementation. This hierarchy lets analysts describe behavior at different levels of detail. The other orderings invert or scramble that progression.

Question 18ATT&CK Overview and History

Which statement accurately reflects how ATT&CK identifiers are assigned to techniques and sub-techniques?

  1. Identifiers are assigned per adversary group rather than per technique
  2. Sub-techniques receive entirely new top-level identifiers unrelated to their parent
  3. Identifiers are reused across unrelated techniques once deprecated
  4. A parent technique has an identifier such as T1059, and a sub-technique appends a suffix such as T1059.001 Correct answer.

Explanation

Parent techniques receive identifiers in the form T followed by digits, and sub-techniques extend the parent identifier with a dotted suffix. This convention preserves the relationship between a parent and its children. Identifiers are unique to techniques, not reused arbitrarily or assigned per group.

Question 19ATT&CK Overview and History

An organization observes a technique marked as deprecated in ATT&CK. What is the most accurate interpretation?

  1. The technique can no longer be performed by any adversary
  2. The technique has been reclassified as a mitigation
  3. The technique now applies only to mobile platforms
  4. The technique entry has been superseded or retired, so analysts should consult the replacement guidance Correct answer.

Explanation

Deprecation signals that an entry has been retired or replaced, often by a more precise technique, and the entry usually points to what supersedes it. It does not mean adversaries are incapable of the behavior. Deprecation is a curation decision about the knowledge base, not a reclassification into a mitigation or a platform restriction.

Question 20ATT&CK Overview and History

Why does ATT&CK separate its content into distinct technology domains such as Enterprise, Mobile, and ICS?

  1. Because each domain is maintained by a different government agency
  2. Because techniques cannot share names across domains
  3. Because domains correspond to different ATT&CK version numbers
  4. Because adversary behavior and defensive context differ meaningfully across those environments Correct answer.

Explanation

Different environments have different architectures, constraints, and defensive priorities, so behaviors and tactics are modeled separately to remain meaningful. All domains are maintained within the same ATT&CK effort rather than by separate agencies. Naming overlap and versioning are not the reason for the split.

Question 21ATT&CK Overview and History

A team wants to compare its detection coverage against a specific threat actor known to target its sector. Which combination of ATT&CK elements is most useful?

  1. The Campaign entries and the platform list
  2. The tactic names and the matrix column order
  3. The Group entry and the techniques and software attributed to it Correct answer.
  4. The Mitigations list and the Data Sources list

Explanation

A Group entry aggregates the techniques and software attributed to that actor, giving a behavior profile that can be compared against existing detections. Mitigations and Data Sources describe defenses and evidence sources rather than actor behavior. Tactic names and platform lists provide structure but not the actor-specific profile.

Question 22ATT&CK Overview and History

Which statement best captures the difference between ATT&CK and a vulnerability-centric framework such as CVE?

  1. ATT&CK catalogs software vulnerabilities, while CVE catalogs adversary behaviors
  2. Both catalog adversary behaviors but differ only in naming conventions
  3. ATT&CK catalogs adversary behaviors, while CVE catalogs specific software vulnerabilities Correct answer.
  4. Both catalog vulnerabilities but differ only in scoring methodology

Explanation

ATT&CK focuses on how adversaries behave, independent of any single vulnerability, whereas CVE identifies specific vulnerabilities in products. The two are complementary: an exploit of a CVE may appear as a procedure under an ATT&CK technique. They are not interchangeable catalogs of the same content.

Question 23ATT&CK Overview and History

Which ATT&CK tactic most directly addresses an adversary's efforts to steal data out of the victim environment?

  1. Exfiltration Correct answer.
  2. Impact
  3. Command and Control
  4. Collection

Explanation

Exfiltration covers techniques for transferring stolen data out of the environment. Collection concerns gathering the data first, Command and Control concerns communicating with compromised systems, and Impact concerns disrupting or destroying systems and data. Each names a distinct goal in the adversary lifecycle.

Question 24ATT&CK Overview and History

Which statement about ATT&CK versioning and community input is most accurate?

  1. ATT&CK updates are issued only when a new operating system is released
  2. ATT&CK content is generated automatically without human review
  3. ATT&CK is frozen and no longer receives updates
  4. ATT&CK is updated periodically, and practitioners can submit contributions that are reviewed before inclusion Correct answer.

Explanation

ATT&CK evolves through periodic releases, and the community can propose new techniques, software, and groups, which are reviewed before being incorporated. Updates are not tied to operating system releases, and content is curated rather than generated automatically. The framework is actively maintained.

Question 25Adversary Tactics and the Enterprise Matrix

In MITRE ATT&CK, which term describes the highest-level adversary goal, such as Persistence or Credential Access, that organizes related techniques?

  1. Mitigation
  2. Software
  3. Tactic Correct answer.
  4. Procedure

Explanation

A tactic is the adversary's tactical goal - the reason an action is performed - and the Enterprise matrix columns are named after tactics. Techniques and sub-techniques describe how that goal is achieved, while procedures are the specific implementations observed in the wild.

Question 26Adversary Tactics and the Enterprise Matrix

Which ATT&CK component is defined as a specific observed instance of how a threat actor carried out a technique, often documented in intrusion reporting?

  1. Data Source
  2. Platform
  3. Tactic
  4. Procedure Correct answer.

Explanation

Procedures are the concrete, actor-specific implementations of a technique, such as the exact command line or tool a group used. They sit at the most granular level of the ATT&CK hierarchy beneath tactics and techniques.

Question 27Adversary Tactics and the Enterprise Matrix

Which tactic column contains techniques such as Phishing and Spearphishing Attachment, where the adversary attempts to gain initial access to a network?

  1. Lateral Movement
  2. Initial Access Correct answer.
  3. Reconnaissance
  4. Execution

Explanation

Initial Access covers techniques that use various entry vectors to gain a foothold in a target network, and phishing variants are canonical examples. Execution concerns running malicious code after access, while Reconnaissance precedes targeting.

Question 28Adversary Tactics and the Enterprise Matrix

An analyst maps a discovered technique to the tactic that represents the adversary's immediate goal of running malicious code on a victim host. Which tactic is this?

  1. Collection
  2. Exfiltration
  3. Execution Correct answer.
  4. Persistence

Explanation

Execution is the tactic representing the adversary's goal of running malicious code, and techniques like Command and Scripting Interpreter and Scheduled Task/Job belong there. Persistence keeps access, Collection gathers data, and Exfiltration removes it from the network.

Question 29Adversary Tactics and the Enterprise Matrix

Which Enterprise tactic groups techniques that adversaries use to keep a foothold after reboots or credential changes, such as creating a new local account?

  1. Discovery
  2. Persistence Correct answer.
  3. Defense Evasion
  4. Privilege Escalation

Explanation

Persistence consists of techniques that adversaries use to maintain access across interruptions such as restarts, credential resets, or lost connections, and creating accounts or scheduled tasks are typical examples. Privilege Escalation is about gaining higher permissions rather than retaining access.

Question 30Adversary Tactics and the Enterprise Matrix

In the ATT&CK matrix layout, what is the relationship between a tactic and a technique?

  1. A technique column contains many tactics arranged by platform.
  2. A tactic column lists techniques that achieve that adversary goal. Correct answer.
  3. A tactic is a sub-technique of a technique with the same name.
  4. A technique belongs to exactly one platform and no tactic.

Explanation

The Enterprise matrix is organized with tactics as columns and techniques as the entries within each column, because each technique serves a tactical goal. Techniques can appear under multiple tactics and apply to several platforms.

Question 31Adversary Tactics and the Enterprise Matrix

A defender wants to know which ATT&CK tactic corresponds to an adversary searching a compromised host for files with sensitive extensions. Which tactic applies?

  1. Collection Correct answer.
  2. Resource Development
  3. Impact
  4. Command and Control

Explanation

Collection covers techniques adversaries use to gather data of interest, such as searching local systems for files before exfiltration. Resource Development concerns building infrastructure and capabilities before operations, not gathering victim data.

Question 32Adversary Tactics and the Enterprise Matrix

Which ATT&CK tactic describes techniques for communicating with compromised systems to control them, such as using application layer protocols?

  1. Exfiltration
  2. Lateral Movement
  3. Discovery
  4. Command and Control Correct answer.

Explanation

Command and Control represents how adversaries communicate with systems under their control within a victim network, including application layer protocol abuse and encrypted channels. Exfiltration concerns moving data out, not issuing instructions.

Question 33Adversary Tactics and the Enterprise Matrix

A threat report notes an adversary used a signed binary to proxy execution of malicious code, then deleted event logs. Which pair of ATT&CK tactics do these behaviors map to?

  1. Execution and Discovery
  2. Defense Evasion and Persistence
  3. Defense Evasion and Defense Evasion Correct answer.
  4. Privilege Escalation and Collection

Explanation

Signed binary proxy execution (T1218) and indicator removal such as clearing logs (T1070) both serve the Defense Evasion tactic, which covers techniques to avoid detection. A single action can be mapped to multiple tactics, but here both behaviors fall under Defense Evasion.

Question 34Adversary Tactics and the Enterprise Matrix

An adversary compromises a workstation, then uses stolen credentials to authenticate to a file server. Which ATT&CK tactic best characterizes the second action?

  1. Initial Access
  2. Lateral Movement Correct answer.
  3. Credential Access
  4. Persistence

Explanation

Lateral Movement consists of techniques used to enter and control remote systems, such as using valid accounts to move from one host to another after the initial foothold. Initial Access applies to the first entry into the network, not subsequent hops.

Question 35Adversary Tactics and the Enterprise Matrix

Which ATT&CK tactic includes techniques for stealing data and transferring it out of the victim network, such as over a command and control channel?

  1. Collection
  2. Exfiltration Correct answer.
  3. Impact
  4. Discovery

Explanation

Exfiltration covers techniques adversaries use to steal data from the network, including transfer over C2 channels or alternative protocols. Collection precedes it by gathering the data, while Impact covers disruption or destruction.

Question 36Adversary Tactics and the Enterprise Matrix

In ATT&CK, what distinguishes a sub-technique from its parent technique?

  1. A sub-technique is a tactic that appears only on mobile platforms.
  2. A sub-technique is a mitigation that reduces the parent technique's risk.
  3. A sub-technique is a group entry describing a threat actor's campaign.
  4. A sub-technique is a more specific description of how a technique is performed. Correct answer.

Explanation

Sub-techniques provide a more specific, lower-level description of adversary behavior under a parent technique, such as distinguishing OS credential dumping methods. They inherit the parent's tactic mapping and carry their own detection guidance.

Question 37Adversary Tactics and the Enterprise Matrix

A SOC analyst wants to enumerate the ATT&CK techniques that apply to macOS and Linux hosts running in the enterprise. Which matrix view should be used?

  1. ICS matrix
  2. PRE-ATT&CK tactics only
  3. Mobile matrix
  4. Enterprise matrix platform filters Correct answer.

Explanation

The Enterprise matrix covers Windows, macOS, Linux, and cloud and includes platform filters that let defenders restrict techniques to the operating systems in scope. The Mobile and ICS matrices target different environments entirely.

Question 38Adversary Tactics and the Enterprise Matrix

Which ATT&CK tactic covers techniques an adversary uses to gather information about the victim environment, such as enumerating accounts and network connections?

  1. Reconnaissance
  2. Collection
  3. Discovery Correct answer.
  4. Resource Development

Explanation

Discovery consists of techniques an adversary uses to gain knowledge about the system and internal network after gaining access, such as account, permission, and network enumeration. Reconnaissance occurs before access and targets the victim from outside.

Question 39Adversary Tactics and the Enterprise Matrix

An attacker exploits a local vulnerability to move from a standard user to SYSTEM on the same host. Under which ATT&CK tactic is this behavior categorized?

  1. Initial Access
  2. Defense Evasion
  3. Privilege Escalation Correct answer.
  4. Lateral Movement

Explanation

Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network, including exploitation for privilege escalation. Lateral Movement would involve reaching a different host rather than elevating on the same one.

Question 40Adversary Tactics and the Enterprise Matrix

Which ATT&CK tactic covers techniques that manipulate or destroy data and systems, such as data destruction or service stop?

  1. Impact Correct answer.
  2. Collection
  3. Exfiltration
  4. Defense Evasion

Explanation

Impact covers techniques adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes, including data destruction and service stop. Exfiltration removes data rather than destroying it.

Question 41Adversary Tactics and the Enterprise Matrix

A red team maps its operation to ATT&CK and finds one technique appears under both Execution and Persistence. How should this be interpreted?

  1. The technique must be split into two sub-techniques first.
  2. The mapping is invalid because each technique belongs to one tactic.
  3. The matrix duplicate is an error that defenders should ignore.
  4. The technique serves multiple adversary goals depending on context. Correct answer.

Explanation

Techniques can be mapped to more than one tactic when the same behavior supports different goals in different contexts, which is why ATT&CK lists them in multiple columns. Defenders should treat the behavior as relevant to each associated tactic rather than forcing a single mapping.

Question 42Adversary Tactics and the Enterprise Matrix

When prioritizing detection coverage, why do defenders often start with techniques mapped to the Execution and Persistence tactics?

  1. Those tactics apply exclusively to cloud environments.
  2. Those tactics represent behaviors that directly enable and sustain adversary operations. Correct answer.
  3. Those tactics contain only techniques that require no credentials.
  4. Those tactics are the only ones with associated data sources.

Explanation

Execution and Persistence describe behaviors that let adversaries run code and keep access, so detecting them disrupts the operation's core. Prioritization should still be threat-informed, but these tactics are common early coverage targets because they are fundamental to adversary success.

Question 43Adversary Tactics and the Enterprise Matrix

A vendor tool reports an alert labeled 'T1059'. What does this identifier represent in ATT&CK?

  1. A technique identifier Correct answer.
  2. A tactic column identifier
  3. A mitigation identifier
  4. A group identifier

Explanation

Identifiers beginning with T denote techniques, and T1059 is Command and Scripting Interpreter. Tactics use TA-prefixed identifiers, groups use G-prefixed identifiers, and mitigations use M-prefixed identifiers.

Question 44Adversary Tactics and the Enterprise Matrix

Which ATT&CK tactic covers adversary activity before compromise, such as scanning victim infrastructure and gathering victim identity information?

  1. Reconnaissance Correct answer.
  2. Resource Development
  3. Initial Access
  4. Discovery

Explanation

Reconnaissance consists of techniques adversaries use to actively or passively gather information about the victim that can be used to support targeting, and it occurs before access. Discovery is similar in spirit but happens after the adversary is inside the environment.

Question 45Adversary Tactics and the Enterprise Matrix

An adversary establishes command and control using a legitimate cloud service, then uses it to move tooling onto victim hosts. Which combination of tactics does this behavior span?

  1. Command and Control and Impact
  2. Command and Control and Resource Development
  3. Command and Control and Lateral Movement Correct answer.
  4. Command and Control and Exfiltration

Explanation

Using a cloud service as a control channel is Command and Control, and transferring tools to other internal hosts is Lateral Movement (tool transfer). Resource Development would be acquiring the infrastructure before the operation, not using it to move tooling inside the victim network.

Question 46Adversary Tactics and the Enterprise Matrix

Why does ATT&CK separate Reconnaissance and Resource Development from the tactics that describe activity inside a victim network?

  1. They describe adversary activity that occurs before or outside the victim environment. Correct answer.
  2. They are deprecated tactics retained for historical reporting.
  3. They map only to the Mobile matrix and not the Enterprise matrix.
  4. They apply only to nation-state actors and never to criminal groups.

Explanation

Reconnaissance and Resource Development capture pre-compromise activity such as victim research and infrastructure preparation, which happens outside the victim environment. Keeping them distinct helps defenders distinguish external exposure signals from host-based post-compromise behaviors.

Question 47Adversary Tactics and the Enterprise Matrix

A detection engineer finds a behavior that could be classified as either Credential Access or Defense Evasion depending on whether the credentials were dumped from memory or the security log was cleared. What is the soundest ATT&CK mapping approach?

  1. Map only to Initial Access because credentials were involved.
  2. Map to Impact because credential compromise affects confidentiality.
  3. Map to every tactic the observed behavior actually supports, documenting the evidence. Correct answer.
  4. Map to the tactic whose name alphabetically precedes the other.

Explanation

ATT&CK mapping should be evidence-driven: assign each observed behavior to the tactic or tactics it genuinely serves, and document the supporting evidence. Dumping credentials from memory is Credential Access, while clearing logs is Defense Evasion, and a compound behavior may legitimately map to both.

Question 48Adversary Tactics and the Enterprise Matrix

Which statement best explains why a single ATT&CK technique can appear under multiple tactics such as Persistence and Privilege Escalation?

  1. The same behavior can serve different adversary goals depending on the operation's stage. Correct answer.
  2. Techniques are reclassified each ATT&CK release and moved between columns.
  3. Multiple tactic mapping indicates the technique has no reliable detection.
  4. The matrix duplicates techniques to balance the number of entries per column.

Explanation

A behavior like creating a scheduled task can maintain access or run with elevated context, so it supports both Persistence and Privilege Escalation depending on intent and stage. ATT&CK reflects this by mapping the technique to each applicable tactic rather than forcing one label.

Question 49Adversary Tactics and the Enterprise Matrix

A defender wants to trace an intrusion from the first external scanning activity through data theft. Which ordered sequence of ATT&CK tactics best represents that progression?

  1. Execution, Reconnaissance, Initial Access, Exfiltration
  2. Reconnaissance, Initial Access, Execution, Exfiltration Correct answer.
  3. Reconnaissance, Exfiltration, Execution, Initial Access
  4. Initial Access, Reconnaissance, Exfiltration, Execution

Explanation

A typical intrusion progresses from pre-compromise Reconnaissance to Initial Access, then to running code (Execution), and eventually to removing data (Exfiltration). The other orderings place reconnaissance after access or exfiltration before execution, which contradicts the operational sequence.

Question 50Adversary Tactics and the Enterprise Matrix

In ATT&CK Enterprise, which tactic is placed first in the matrix column order and represents activity conducted before any access to the victim environment?

  1. Collection
  2. Initial Access
  3. Reconnaissance Correct answer.
  4. Discovery

Explanation

The Enterprise matrix orders tactics roughly by adversary progression, and Reconnaissance sits at the far left because it covers information gathering against targets before compromise occurs. Initial Access already assumes the adversary is attempting to enter the victim environment, so it appears later in the sequence.