ATTCK-DEF Practice Test

ATTCK-DEF practice test: what's covered

• Tactics
• Techniques
• Detections
• Threat Intel
• Purple Team
• Coverage Mapping

Free ATTCK-DEF sample questions

1. A security engineer needs to describe adversary behavior in a shared language for SOC and intel teams during a controlled production rollout. Which response is the BEST fit?

   • A. map observed behaviors to ATT&CK tactics and techniques with procedure context — with change evidence recorded
   • B. track only CVE numbers without behavior — with change evidence recorded
   • C. rename every alert to a random color code — with change evidence recorded
   • D. use only malware family marketing names — with change evidence recorded
   Show answer

   Correct: A. map observed behaviors to ATT&CK tactics and techniques with procedure context — with change evidence recorded is the best answer because ATT&CK provides a common matrix for adversary behavior across teams. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes technique IDs, tactic stage, and procedure notes.

2. An administrator must describe adversary behavior in a shared language for SOC and intel teams while investigating an urgent support case. Which action should be taken first?

   • A. map observed behaviors to ATT&CK tactics and techniques with procedure context — after confirming scope and ownership
   • B. track only CVE numbers without behavior — after confirming scope and ownership
   • C. rename every alert to a random color code — after confirming scope and ownership
   • D. use only malware family marketing names — after confirming scope and ownership
   Show answer

   Correct: A. map observed behaviors to ATT&CK tactics and techniques with procedure context — after confirming scope and ownership is the best answer because ATT&CK provides a common matrix for adversary behavior across teams. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes technique IDs, tactic stage, and procedure notes.

3. A company plans to describe adversary behavior in a shared language for SOC and intel teams during an audit-readiness review. Which design best meets the requirement?

   • A. map observed behaviors to ATT&CK tactics and techniques with procedure context — using the vendor-supported workflow
   • B. track only CVE numbers without behavior — using the vendor-supported workflow
   • C. rename every alert to a random color code — using the vendor-supported workflow
   • D. use only malware family marketing names — using the vendor-supported workflow
   Show answer

   Correct: A. map observed behaviors to ATT&CK tactics and techniques with procedure context — using the vendor-supported workflow is the best answer because ATT&CK provides a common matrix for adversary behavior across teams. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes technique IDs, tactic stage, and procedure notes.

4. During troubleshooting, the team must describe adversary behavior in a shared language for SOC and intel teams after a regional service change. Which next step is most defensible?

   • A. map observed behaviors to ATT&CK tactics and techniques with procedure context — with least privilege preserved
   • B. track only CVE numbers without behavior — with least privilege preserved
   • C. rename every alert to a random color code — with least privilege preserved
   • D. use only malware family marketing names — with least privilege preserved
   Show answer

   Correct: A. map observed behaviors to ATT&CK tactics and techniques with procedure context — with least privilege preserved is the best answer because ATT&CK provides a common matrix for adversary behavior across teams. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes technique IDs, tactic stage, and procedure notes.

5. An administrator needs to describe adversary behavior in a shared language for SOC and intel teams before approving a high-risk release. Which TWO actions provide the strongest implementation and verification? (Choose TWO)

   • A. map observed behaviors to ATT&CK tactics and techniques with procedure context — with monitoring and rollback defined
   • B. verify the result using technique IDs, tactic stage, and procedure notes — with monitoring and rollback defined
   • C. track only CVE numbers without behavior — with monitoring and rollback defined
   • D. rename every alert to a random color code — with monitoring and rollback defined
   • E. use only malware family marketing names — with monitoring and rollback defined
   Show answer

   Correct: A and B. map observed behaviors to ATT&CK tactics and techniques with procedure context — with monitoring and rollback defined and verify the result using technique IDs, tactic stage, and procedure notes — with monitoring and rollback defined are correct because ATT&CK provides a common matrix for adversary behavior across teams. The other options are not appropriate: they weaken scope, skip a required control, or do not provide reliable evidence for this MITRE ATT&CK Defender scenario.

Last updated: 2026-10-19

ATTCK-DEF practice test FAQ