PUR301 Final Revision

Red Teams use the MITRE ATT&CK Framework to simulate adversaries based on:

• Imaginary tactics and techniques

• Fictitious tactics and techniques

• Made up tactics and techniques

• Real-World tactics and techniques

In a purple team engagement, the red team______________.

• Use use imaginative made-up tactics from imaginary adversaries.

• Performs tasks that emulate real-world adversary attacks.

• Monitor for real-word simulated attacks.

• Perform pen testing of the target system.

The goal of precision is to have less of these.

• True Negatives

• False Negatives

• True Positives

• False Positives

In purple team exercises, the blue team _______________.

• Pretends to be a real life SOC team to catch fictitious attacks.

• Acts as a real-life adversary using TTPs for attack.

• Assists the red team in monitoring their pen testing

• Evaluates and improves the organization's detection capabilities

Optimizing precision means _____________.

• Reducing false alarms

• Keeping the signal to noise ratio down

• Detecting false alarms

• maximizing alert frequency

Hiding malicious software within system files is a technique under what tactic?

The term used to measure the percentage of true threats correctly identified in detection engineering.

• precision

• signature based detective

• recall

• allow list

Detecting new and previously unknown threats is an advantage of which detection mechanism?

• anomaly-based detection

• signature based detection

• allow list

• precision

A detection method used to identify behaviors that differ from the baseline or norms is called what?

• Allow-list detection

• Signature-based detection

• Anomaly-based detection

• Behavioral-based detection

Modifying the registry run keys or the startup folder are examples of this tactic from the MITRE ATT&CK Framework.