I85PREP
⌘ K
ATT&CK Threat Hunting study materials
ATT&CK Threat Hunting study resources

ATT&CK Threat Hunting practice questions

One question at a time. Build your ATT&CK Threat Hunting understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ATT&CK Framework Fundamentals and Data Model

In the ATT&CK data model, which object represents a specific adversary activity or intrusion set that is tracked and named by threat intelligence?

  1. Technique
  2. Mitigation
  3. Tactic
  4. Group Correct answer.

Explanation

A Group (also called an intrusion set or activity group) is the ATT&CK object used to represent a named adversary or cluster of related activity. Tactics and techniques describe behavior categories, and mitigations describe defenses, not actors.

Question 2ATT&CK Framework Fundamentals and Data Model

Which ATT&CK object answers the question 'what is the adversary trying to achieve' at the highest level of abstraction?

  1. Procedure
  2. Data Component
  3. Software
  4. Tactic Correct answer.

Explanation

Tactics are the adversary's tactical goals, such as Persistence or Credential Access, and form the columns of the Enterprise matrix. Software, data components, and procedures sit at different, more concrete levels of the model.

Question 3ATT&CK Framework Fundamentals and Data Model

A hunting team wants the most specific description of how one group implemented a technique, including the exact command line observed. Which ATT&CK concept captures that level of detail?

  1. Procedure Correct answer.
  2. Data Source
  3. Tactic
  4. Platform

Explanation

A procedure is the specific implementation of a technique as carried out by a group or software, and it is the most granular level of the model. Tactics are goals, platforms are operating environments, and data sources are telemetry categories.

Question 4ATT&CK Framework Fundamentals and Data Model

Which identifier format does ATT&CK use for techniques in the Enterprise matrix?

  1. S followed by four digits, such as S0002
  2. TA followed by four digits, such as TA0002
  3. T followed by four digits, such as T1059 Correct answer.
  4. M followed by four digits, such as M1042

Explanation

Techniques are identified with a T-prefixed number, for example T1059 for Command and Scripting Interpreter. Sub-techniques append a three-digit suffix such as T1059.001. The TA, S, and M prefixes denote tactics, software, and mitigations respectively.

Question 5ATT&CK Framework Fundamentals and Data Model

A technique page lists 'Windows' and 'Linux' under its platforms. What does this tell a hunter?

  1. Only those platforms can ever be attacked using the technique
  2. The technique has documented applicability on those operating systems Correct answer.
  3. The technique is deprecated on all other platforms
  4. The technique is detected identically on both platforms

Explanation

Platforms record where a technique has been observed or is applicable, guiding which log sources and environments to hunt in. They do not assert that other platforms are immune, nor that detection logic is identical across them.

Question 6ATT&CK Framework Fundamentals and Data Model

Which statement best describes the relationship between tactics and techniques in ATT&CK?

  1. Tactics and techniques are synonymous categories of malware
  2. A technique is a goal, and tactics are its sub-steps
  3. A tactic is a tool, and techniques are the logs it generates
  4. A tactic is a goal, and techniques are the means used to achieve it Correct answer.

Explanation

ATT&CK organizes techniques under tactics, where the tactic states the adversary's objective and the technique describes a behavior used to accomplish it. Many techniques can map to more than one tactic because one behavior can serve several goals.

Question 7ATT&CK Framework Fundamentals and Data Model

What is the primary purpose of an ATT&CK mitigation object?

  1. To record the log sources required for detection
  2. To define the tactic a technique belongs to
  3. To describe defensive measures that prevent or reduce the impact of techniques Correct answer.
  4. To list the adversary groups that use a technique

Explanation

Mitigations describe security controls and configuration changes that can prevent a technique or limit its effect. They are linked to techniques so defenders can connect behavior to countermeasures.

Question 8ATT&CK Framework Fundamentals and Data Model

Which ATT&CK object is used to represent a piece of commercial or open-source offensive tooling, distinct from malware?

  1. Group
  2. Malware
  3. Tool Correct answer.
  4. Campaign

Explanation

ATT&CK separates software into tools, which are legitimate utilities repurposed by adversaries, and malware, which is written for malicious purposes. Groups and campaigns describe actors and activity, not software type.

Question 9ATT&CK Framework Fundamentals and Data Model

A technique page shows a sub-technique identifier T1003.001 alongside its parent T1003. What does the parent-child structure indicate?

  1. The parent is deprecated and replaced by the sub-technique
  2. The two identifiers refer to unrelated behaviors
  3. The sub-technique applies only to a single platform
  4. The sub-technique is a more specific variant of the broader parent technique Correct answer.

Explanation

Sub-techniques provide finer-grained descriptions of a parent technique, such as a specific credential-dumping method under OS Credential Dumping. The parent remains valid and groups the variants together.

Question 10ATT&CK Framework Fundamentals and Data Model

A hunter selects the 'Data Components' listed on a technique page. What are they used for?

  1. Listing the mitigations that block the technique
  2. Naming the adversary groups known to use the technique
  3. Identifying the specific kinds of telemetry that can reveal the behavior Correct answer.
  4. Specifying the operating systems where the technique works

Explanation

Data components describe the concrete types of observable data, under broader data sources, that detection analytics rely on for a technique. They help hunters translate a behavior into log and sensor requirements.

Question 11ATT&CK Framework Fundamentals and Data Model

An analyst wants to see all techniques attributed to a specific named threat group. Which ATT&CK relationship directly supports this?

  1. Group-to-technique mappings Correct answer.
  2. Tactic-to-mitigation mappings
  3. Data-source-to-platform mappings
  4. Software-to-mitigation mappings

Explanation

ATT&CK maps groups to the techniques they have been observed using, and the reverse view lists groups per technique. This mapping is the standard way to pivot from an actor to its known behaviors.

Question 12ATT&CK Framework Fundamentals and Data Model

Why does ATT&CK use a matrix layout for Enterprise, Mobile, and ICS?

  1. Each matrix corresponds to a different year of releases
  2. Each matrix scopes techniques to a technology domain with its own tactics Correct answer.
  3. Each matrix is a separate license tier
  4. Each matrix represents a different adversary group

Explanation

ATT&CK maintains separate matrices because tactics and techniques differ meaningfully across enterprise IT, mobile, and industrial control systems. The matrix is a domain-scoped view, not an actor or licensing artifact.

Question 13ATT&CK Framework Fundamentals and Data Model

A hunt produces evidence of an adversary disabling audit logging before further actions. Which tactic most directly frames this behavior in ATT&CK?

  1. Lateral Movement
  2. Defense Evasion Correct answer.
  3. Collection
  4. Resource Development

Explanation

Impairing defenses such as logging or security tooling is categorized under Defense Evasion, because the adversary is trying to avoid detection. Collection, Lateral Movement, and Resource Development describe other objectives.

Question 14ATT&CK Framework Fundamentals and Data Model

A detection engineer sees the technique 'Command and Scripting Interpreter' and wants to scope detection to PowerShell specifically. What is the correct ATT&CK approach?

  1. Use the software entry for PowerShell
  2. Use the mitigation entry for PowerShell
  3. Search for a separate tactic named PowerShell
  4. Use the relevant sub-technique, such as PowerShell, under the parent technique Correct answer.

Explanation

Specific interpreters are modeled as sub-techniques beneath the parent Command and Scripting Interpreter technique. This keeps the broad behavior grouped while allowing precise detection and reporting at the sub-technique level.

Question 15ATT&CK Framework Fundamentals and Data Model

What distinguishes a Campaign object from a Group object in ATT&CK?

  1. A campaign is a mitigation, while a group is a data source
  2. A campaign is a software family, while a group is a tool
  3. A campaign is a tactic, while a group is a technique
  4. A campaign is a specific time-bounded set of activity, while a group is the broader actor identity Correct answer.

Explanation

Campaigns describe a particular coordinated effort within a bounded timeframe, often tied to a named operation. Groups represent the enduring adversary identity that may conduct multiple campaigns.

Question 16ATT&CK Framework Fundamentals and Data Model

An analyst maps an observed behavior to two different tactics. How should this be interpreted within ATT&CK?

  1. It means the behavior is not a real technique
  2. It indicates a data entry error, since techniques map to one tactic only
  3. It means the technique is deprecated
  4. It is expected, because a single technique can serve multiple adversary goals Correct answer.

Explanation

ATT&CK allows a technique to appear under multiple tactics when the same behavior can advance different objectives, such as a scripting interpreter used for both execution and discovery. Analysts should record the tactic that best matches observed intent.

Question 17ATT&CK Framework Fundamentals and Data Model

A threat hunter is choosing between hunting at the technique level versus the sub-technique level. What is the main tradeoff?

  1. Sub-technique hunts are more precise but narrower, while technique-level hunts cover more variants Correct answer.
  2. Sub-techniques are not linked to data sources
  3. Technique-level hunts cannot use data components
  4. Sub-technique hunts always require fewer log sources

Explanation

Hunting a sub-technique focuses analytics on a specific implementation and reduces false positives, but may miss sibling variants. Hunting at the parent technique level broadens coverage at the cost of precision.

Question 18ATT&CK Framework Fundamentals and Data Model

Which ATT&CK field would a hunter consult first to determine whether a technique is relevant to a macOS-only fleet?

  1. Group associations
  2. Platforms Correct answer.
  3. Campaign associations
  4. Mitigations

Explanation

The platforms field records the operating systems and environments where a technique applies, so it is the direct filter for environment relevance. Mitigations and actor associations inform response and prioritization but not platform applicability.

Question 19ATT&CK Framework Fundamentals and Data Model

A report needs to cite the ATT&CK entry for a named malware family. Which identifier prefix and object type should be used?

  1. A T-prefixed technique identifier for the malware
  2. A TA-prefixed tactic identifier for the malware
  3. An S-prefixed software identifier for the malware Correct answer.
  4. An M-prefixed mitigation identifier for the malware

Explanation

Malware families are modeled as software objects with S-prefixed identifiers. Techniques, mitigations, and tactics use different prefixes and describe behavior, controls, and goals rather than malware identity.

Question 20ATT&CK Framework Fundamentals and Data Model

A hunter notices that a technique's detection guidance references a data component the organization does not collect. What is the most appropriate ATT&CK-informed next step?

  1. Conclude the technique cannot occur in the environment
  2. Assume the group does not use that technique
  3. Replace the technique with a mitigation in the hunt plan
  4. Record the telemetry gap and prioritize sensor or logging coverage for that data component Correct answer.

Explanation

Data components translate techniques into concrete telemetry needs, so an uncollected component represents a visibility gap to be remediated or documented as residual risk. Absence of telemetry says nothing about whether the behavior can occur.

Question 21ATT&CK Framework Fundamentals and Data Model

Two techniques both describe credential access, but one is a sub-technique of the other. A hunter wants coverage across all variants without duplicating analytics. Which approach best reflects the ATT&CK hierarchy?

  1. Treat each sub-technique as an unrelated parent technique
  2. Build only the parent analytic and ignore all sub-techniques
  3. Build a parent-level analytic for shared behavior and add sub-technique-specific analytics where telemetry differs Correct answer.
  4. Build only sub-technique analytics and discard the parent entirely

Explanation

The hierarchy supports layered detection: shared behavior can be covered once at the parent level, while variant-specific telemetry justifies separate sub-technique analytics. Discarding either layer loses coverage or creates blind spots.

Question 22ATT&CK Framework Fundamentals and Data Model

A team maps every alert in its SIEM to ATT&CK techniques to measure coverage. Which limitation of ATT&CK-based coverage metrics should they account for?

  1. Coverage metrics require paid ATT&CK licensing
  2. Technique coverage counts do not measure detection quality, telemetry fidelity, or adversary relevance Correct answer.
  3. ATT&CK techniques are too few to map SIEM alerts against
  4. ATT&CK mappings cannot be applied to SIEM content

Explanation

Mapping alerts to techniques shows breadth of behavior addressed, but a technique can be 'covered' by a weak or noisy analytic, and coverage says little about which behaviors matter for the organization's threats. Quality and relevance must be assessed separately.

Question 23ATT&CK Framework Fundamentals and Data Model

An analyst finds a technique whose ATT&CK entry was deprecated and superseded. What is the correct handling when updating an old hunt document?

  1. Delete the behavior from the hunt plan entirely
  2. Remap the behavior to the current replacement technique and note the change Correct answer.
  3. Convert the deprecated technique into a mitigation
  4. Keep the deprecated identifier because old documents are immutable

Explanation

Deprecated techniques are retained for historical traceability but should be remapped to their replacements in active documentation and detection content. Keeping stale identifiers degrades reporting consistency and coverage analysis.

Question 24ATT&CK Framework Fundamentals and Data Model

Why is procedure-level detail valuable when a hunter already has technique-level mappings for an intrusion?

  1. It provides the mitigation for the technique
  2. It identifies the tactic the adversary intended
  3. It reveals the concrete commands and artifacts that generate huntable evidence Correct answer.
  4. It replaces the need for data components

Explanation

Procedures describe how a specific actor implemented a technique, yielding concrete command lines, file paths, and other observables that can be turned into hunts. Technique mappings alone describe the category of behavior, not the artifacts.

Question 25ATT&CK Framework Fundamentals and Data Model

A hunter needs to record which data source category, such as process creation or network traffic, supports detection of a behavior. Which ATT&CK element provides that categorization?

  1. Data Source Correct answer.
  2. Mitigation
  3. Campaign
  4. Tactic

Explanation

Data sources group the broad categories of information, with data components beneath them, that detection of a technique depends on. Mitigations, campaigns, and tactics describe defenses, activity sets, and goals instead.

Question 26ATT&CK Framework Fundamentals and Data Model

In ATT&CK, what does the STIX-based data model use to express that a Group has used a particular Technique?

  1. A matrix column header that lists the group by name
  2. A mitigation object bound to the group identifier
  3. A nested list stored inside the technique's description field
  4. A relationship object connecting the intrusion-set to the attack-pattern Correct answer.

Explanation

ATT&CK is distributed as STIX 2.x, where entities are separate objects and their connections are expressed as explicit relationship objects. A group (intrusion-set) and a technique (attack-pattern) are joined by a relationship of type 'uses', so the link carries its own identifier and can be cited or queried. The relationship therefore exists outside either object's text fields.

Question 27ATT&CK Framework Fundamentals and Data Model

An analyst is reading a technique page and wants to know which specific adversary behaviors the ATT&CK team has documented as real-world examples of that technique. Which section of the page provides this?

  1. The procedure examples section, which lists named groups, campaigns, or software observed using the technique Correct answer.
  2. The tactic header, which names the column the technique sits under
  3. The platforms field, which enumerates operating systems where the technique applies
  4. The data components section, which lists the telemetry needed for detection

Explanation

Procedure examples are the concrete, attributed instances of how a technique has been carried out in the wild, and they are linked to named groups, campaigns, or software. They sit below the abstract technique description and give hunters realistic context for what the behavior looks like. The other fields describe scope or telemetry, not observed instances.

Question 28ATT&CK Framework Fundamentals and Data Model

A hunter is reviewing a technique entry and notes that its 'Detection' section describes generic, vendor-neutral logic rather than a ready-to-deploy rule. How should this shape the hunter's use of that section?

  1. Treat it as a starting hypothesis about observable artifacts, then translate it into queries against the organization's own telemetry Correct answer.
  2. Use it only to confirm that the technique is in scope for the organization's platform list
  3. Apply it verbatim as a production detection rule because ATT&CK detection text is maintained as deployable logic
  4. Ignore it entirely, since ATT&CK detection guidance is not intended to inform hunting at all

Explanation

ATT&CK detection guidance is deliberately high level and describes what evidence a behavior may leave behind, not a finished analytic. Hunters must adapt it to the sensors, field names, and baselines they actually have. Treating it as a hypothesis keeps the guidance useful without overstating its precision.

Question 29ATT&CK Framework Fundamentals and Data Model

A hunter wants to express that a technique applies to a container orchestration platform as well as traditional hosts. Which ATT&CK attribute is designed to capture this applicability?

  1. The permissions required field on the technique object
  2. The platforms field on the technique object Correct answer.
  3. The tactic assignment of the technique in the matrix
  4. The sub-technique identifier suffix

Explanation

The platforms field lists the environments in which a technique has been observed or is expected to work, such as Windows, Linux, macOS, or container platforms. It is the attribute hunters use to filter a large matrix down to what is relevant to their estate. Tactic assignment, permissions, and identifier structure answer different questions.

Question 30ATT&CK Framework Fundamentals and Data Model

A hunter is comparing two ATT&CK releases and finds that a technique's identifier still exists but its tactic assignments have changed, with the technique now appearing under an additional tactic. What is the most defensible interpretation of this change?

  1. The identifier now refers to a different, unrelated behavior and prior mappings are invalid
  2. The technique has been deprecated and should be removed from all existing detection mappings
  3. The change is purely cosmetic and carries no meaning for coverage measurement
  4. The same behavior can serve more than one adversary goal, and the update reflects expanded analytic coverage rather than a new technique Correct answer.

Explanation

ATT&CK revisions frequently re-map a technique to additional tactics when analysis shows the behavior can advance more than one goal, such as a single utility used for both execution and defense evasion. Because the identifier is stable, existing mappings remain valid but coverage should be reassessed against the added tactic. This is a semantic update, not a deprecation or a redefinition of the behavior.

Question 31Threat Intelligence Mapping to ATT&CK

In ATT&CK, what is the difference between a technique and a sub-technique?

  1. A technique applies only to Windows, while a sub-technique applies to all platforms
  2. A technique is a detection rule, while a sub-technique is the log source that feeds it
  3. A technique is a top-level adversarial goal, while a sub-technique is a specific implementation of that goal Correct answer.
  4. A technique is a threat actor group, while a sub-technique is the malware it uses

Explanation

ATT&CK organizes behavior hierarchically: a technique describes a general adversary objective (for example, command and scripting interpreter), and sub-techniques such as PowerShell or Unix shell capture the specific implementation. Sub-techniques inherit the tactic associations of their parent and add platform-specific detail that improves mapping precision.

Question 32Threat Intelligence Mapping to ATT&CK

An analyst observes a process writing a malicious payload into the Run key of the registry so it executes at logon. Which ATT&CK tactic best describes the adversary's objective?

  1. Lateral Movement
  2. Privilege Escalation
  3. Credential Access
  4. Persistence Correct answer.

Explanation

Modifying an autostart location such as a Run key ensures the adversary's code executes after reboot or logon, which is the definition of Persistence. The same action can also be tagged with a second tactic when it grants elevated execution, but the primary objective here is maintaining access.

Question 33Threat Intelligence Mapping to ATT&CK

What does an ATT&CK technique's detection field contain in current ATT&CK releases?

  1. A signature file that can be deployed directly to an IDS
  2. A description of data sources and analytic opportunities that could reveal the behavior Correct answer.
  3. The MITRE-assigned severity score for the technique
  4. A list of threat groups known to use the technique

Explanation

The detection field offers prose guidance on what telemetry to collect and how to reason about detecting the behavior, not a ready-to-run rule. It is descriptive and vendor-neutral, so hunters must translate it into queries for their own environment.

Question 34Threat Intelligence Mapping to ATT&CK

A hunting team wants to map a newly discovered intrusion to ATT&CK. Which approach most closely follows the intended methodology?

  1. Copy the technique list from a published report about a different actor
  2. Assign the intrusion to a single technique that best summarizes the campaign
  3. Map each observed behavior to the technique and tactic it represents, using procedure examples to validate the choice Correct answer.
  4. Map the malware's file hash to the closest technique name

Explanation

ATT&CK mapping is behavior-driven: each observable action is matched to the technique whose definition and procedure examples it fits, and the associated tactics follow from that technique. Validating against procedure examples keeps mappings consistent and defensible across analysts.

Question 35Threat Intelligence Mapping to ATT&CK

Which ATT&CK object represents a named intrusion set that MITRE tracks, such as a financially motivated or state-sponsored cluster of activity?

  1. Intrusion Set Correct answer.
  2. Campaign
  3. Data Component
  4. Software

Explanation

An Intrusion Set is the ATT&CK object for a grouped set of adversarial behaviors and resources attributed to a single organization or entity. Campaigns are narrower time-bound efforts, and software objects describe tools and malware.

Question 36Threat Intelligence Mapping to ATT&CK

Why must a hunter be careful when using ATT&CK procedure examples as a hunting hypothesis?

  1. Procedure examples describe how specific groups or tools implemented a technique, so they reflect known variants rather than every possible implementation Correct answer.
  2. Procedure examples replace the need for telemetry collection
  3. Procedure examples are theoretical and never observed in real intrusions
  4. Procedure examples are only published for Linux platforms

Explanation

Procedure examples anchor a technique to concrete, documented implementations, which makes them useful for hypothesis generation but inherently biased toward what has already been reported. Hunters should treat them as starting points and generalize to unseen variants of the same behavior.

Question 37Threat Intelligence Mapping to ATT&CK

Which statement best describes the relationship between a tactic and a technique in ATT&CK?

  1. A tactic is a detection data source, and techniques are the log fields it produces
  2. A tactic is a specific command line, and techniques are the processes that run it
  3. A tactic is the adversary's tactical goal, and techniques are the means used to achieve it Correct answer.
  4. A tactic is assigned per threat group, and techniques are assigned per malware family

Explanation

Tactics answer why an adversary acts (the objective, such as Discovery or Exfiltration), while techniques answer how the action is performed. A single technique can serve more than one tactic, which is why technique pages list multiple tactic associations.

Question 38Threat Intelligence Mapping to ATT&CK

An analyst is mapping a technique and needs to record which ATT&CK platform it applies to. Which ATT&CK field is designed for that purpose?

  1. The data source name
  2. The kill chain phase
  3. The group description
  4. The platform field on the technique Correct answer.

Explanation

Each technique page carries a platform field listing the systems where the behavior has been observed, such as Windows, Linux, macOS, or cloud services. Checking it prevents mapping a Windows-specific implementation to a Linux host.

Question 39Threat Intelligence Mapping to ATT&CK

A hunt produces a hypothesis that an adversary is using a signed binary proxy execution to bypass application control. Which ATT&CK technique ID most closely matches this behavior?

  1. T1218 System Binary Proxy Execution Correct answer.
  2. T1071 Application Layer Protocol
  3. T1059 Command and Scripting Interpreter
  4. T1055 Process Injection

Explanation

System Binary Proxy Execution (T1218) covers abusing trusted, often signed, system binaries to proxy execution of malicious content, which is exactly the behavior described. Command and Scripting Interpreter covers script engines rather than signed binary proxying.

Question 40Threat Intelligence Mapping to ATT&CK

During mapping, an analyst finds that a single observed action, dumping LSASS memory, could support both Credential Access and Defense Evasion in the environment. What is the most defensible ATT&CK mapping practice?

  1. Record neither tactic until the adversary is attributed
  2. Record every tactic that the technique is associated with and that the evidence supports Correct answer.
  3. Record only the first tactic alphabetically to keep reports consistent
  4. Record only Defense Evasion because dumping memory is stealthy

Explanation

ATT&CK techniques can map to multiple tactics, and the defensible approach is to record each tactic the technique supports when the evidence justifies it. Attribution is not required to map behavior, so mapping can proceed before the actor is known.

Question 41Threat Intelligence Mapping to ATT&CK

A hunter is choosing between two candidate techniques for a scheduled task created via the Windows Task Scheduler. Which evidence most directly distinguishes Scheduled Task/Job from a service-based persistence technique?

  1. The existence of an unsigned binary on disk
  2. The use of an administrative account
  3. The presence of a network connection to a remote host
  4. The presence of a task registration event and a task XML definition referencing the payload Correct answer.

Explanation

Task Scheduler registration telemetry, such as task creation events and the task definition XML, is the artifact that ties the behavior to Scheduled Task/Job rather than to service creation. Network connections, unsigned binaries, and account type are common to many techniques and do not discriminate between them.

Question 42Threat Intelligence Mapping to ATT&CK

Why is the ATT&CK data source and data component model useful when building a hunt plan for a mapped technique?

  1. It guarantees the technique will be detected without further tuning
  2. It identifies the categories of telemetry that could reveal the behavior, guiding collection checks before querying Correct answer.
  3. It assigns a confidence score to each technique mapping
  4. It replaces the need to understand the technique's procedure examples

Explanation

Data sources and components describe the kinds of telemetry, such as process creation or network traffic, that can support detection of a technique. Hunters use them to verify collection coverage before writing queries, which prevents blind spots from being mistaken for absence of activity.

Question 43Threat Intelligence Mapping to ATT&CK

An analyst maps a PowerShell download cradle to Command and Scripting Interpreter: PowerShell. A reviewer argues the mapping should instead be Ingress Tool Transfer. How should the analyst resolve the disagreement?

  1. Choose Ingress Tool Transfer because file transfer always supersedes scripting
  2. Keep both mappings only if the technique IDs are numerically adjacent
  3. Choose neither and escalate to the vendor
  4. Map the behavior to both techniques where each is supported, since the cradle both executes script and transfers a file Correct answer.

Explanation

A single observable can legitimately satisfy more than one technique when the behavior genuinely spans both, and a download cradle does execute script and transfer content. Documenting both with the supporting evidence keeps the mapping faithful to the activity rather than forcing an artificial single choice.

Question 44Threat Intelligence Mapping to ATT&CK

A threat report describes an actor using remote services with valid accounts to move between hosts. Which ATT&CK tactic and technique pairing is most accurate?

  1. Lateral Movement with Remote Services Correct answer.
  2. Collection with Screen Capture
  3. Initial Access with Phishing
  4. Impact with Data Encrypted for Impact

Explanation

Using valid accounts over remote services to reach additional hosts is the canonical Lateral Movement behavior mapped to Remote Services. The tactic reflects the objective of expanding access within the environment.

Question 45Threat Intelligence Mapping to ATT&CK

When mapping a cloud intrusion, an analyst observes creation of a new IAM user with programmatic access keys. Which ATT&CK technique is the best fit?

  1. Valid Accounts under Defense Evasion
  2. Create Account under Persistence Correct answer.
  3. Account Manipulation under Persistence
  4. Brute Force under Credential Access

Explanation

Creating a new identity in a cloud or directory service to retain access maps to Create Account, which covers local, domain, and cloud account creation. Account Manipulation would cover modifying an existing account rather than creating a new one.

Question 46Threat Intelligence Mapping to ATT&CK

A hunting team wants to prioritize techniques that are both prevalent in its sector and poorly covered by current detections. Which ATT&CK-based input best supports that prioritization?

  1. The alphabetical order of technique names
  2. The technique's kill chain phase number
  3. Group and software pages filtered to relevant actors, cross-referenced with an internal detection coverage assessment Correct answer.
  4. The number of procedure examples listed for each technique

Explanation

Prioritization combines threat relevance, drawn from groups and software observed against the sector, with the organization's own detection coverage gaps. Cross-referencing the two produces a ranked list grounded in both likelihood and current blindness.

Question 47Threat Intelligence Mapping to ATT&CK

Which statement correctly describes ATT&CK Software objects?

  1. They describe tools and malware families and list the techniques they have been observed using Correct answer.
  2. They describe detection analytics shipped with the framework
  3. They describe network segments targeted by adversaries
  4. They describe threat actor motivations and funding

Explanation

Software objects cover both legitimate tools abused by adversaries and malware families, and each page lists the techniques associated with that software. This makes them useful for hypothesis generation when a specific tool is suspected in an environment.

Question 48Threat Intelligence Mapping to ATT&CK

A hunter maps an intrusion to twelve techniques but later discovers two were based on a misunderstanding of a log field. What is the best practice for handling the correction?

  1. Update the mapping, document the reason for the revision, and re-check related techniques that relied on the same field Correct answer.
  2. Keep the original mapping and add the correction only in a footnote
  3. Discard the entire mapping and restart from scratch
  4. Silently remove the two techniques to keep the report clean

Explanation

Mapping is iterative, and corrections should be recorded with rationale so the assessment remains auditable. Because a misinterpreted field may affect several mappings, related techniques that depended on it must be re-examined.

Question 49Threat Intelligence Mapping to ATT&CK

Which ATT&CK technique most directly describes adversaries using legitimate remote monitoring and management tools already present in the environment to blend in?

  1. Tool use via Software entries for remote monitoring tools mapped to their techniques Correct answer.
  2. Exploitation for Client Execution
  3. Data Obfuscation
  4. Protocol Tunneling

Explanation

Abuse of legitimate remote monitoring and management software is captured through ATT&CK Software entries for those tools and the techniques they support, such as Remote Services. Mapping the tool and its behaviors together preserves the dual-use nature of the activity.

Question 50Threat Intelligence Mapping to ATT&CK

An analyst is deciding whether an observed behavior is Discovery or Collection. Which question most reliably separates the two tactics?

  1. Did the action occur on a weekday or weekend?
  2. Was the action performed by a signed or unsigned binary?
  3. Did the action generate a network connection?
  4. Does the action gather information about the environment to inform later decisions, or does it gather data of interest for exfiltration? Correct answer.

Explanation

Discovery techniques enumerate hosts, accounts, and configuration to shape the adversary's next move, while Collection techniques stage data the adversary intends to take. The objective behind the data gathering, not the tool or timing, determines the tactic.