CC: Threat Frameworks (MITRE ATT&CK, Cyber Kill Chain)

Question 1

Which characteristic primarily distinguishes the MITRE ATT&CK framework from the Cyber Kill Chain model?

ATT&CK categorizes security controls required for compliance, whereas the Kill Chain dictates specific vulnerability patching schedules. ATT&CK emphasizes automated incident remediation procedures, whereas the Kill Chain categorizes purely offensive adversary techniques. ATT&CK maps exclusively to internal malicious threat actors, whereas the Kill Chain models external state-sponsored cyber campaigns. ATT&CK details specific adversary tactics and techniques in a matrix, whereas the Kill Chain describes a linear sequence of attack phases.

Correct Answer: ATT&CK details specific adversary tactics and techniques in a matrix, whereas the Kill Chain describes a linear sequence of attack phases.

The correct answer is right because the MITRE ATT&CK framework uses a comprehensive knowledge base matrix to detail exactly how adversaries operate through specific tactics and techniques, whereas the Cyber Kill Chain represents a cyberattack as a strict, linear progression of distinct phases.
The other options are incorrect because neither framework automates incident remediation, they are not strictly limited to internal or external threats respectively, and neither is designed primarily for compliance mapping or defining vulnerability patching schedules.
The key concept tested is the functional differences between prominent cybersecurity threat models.

Question 2

An organization is restructuring its threat intelligence program to better defend against advanced persistent threats. The security operations team needs to evaluate and adopt a framework that categorizes specific adversary tactics, techniques, and procedures into a detailed matrix. This structure will help them map existing defensive controls against known malicious behaviors used during an active breach. Which model is the most appropriate choice for achieving this specific objective?

Zero Trust architecture model Cyber Kill Chain methodology Diamond Model of Intrusion MITRE ATT&CK knowledge base

Correct Answer: MITRE ATT&CK knowledge base

The MITRE ATT&CK knowledge base is the most appropriate choice because it provides a globally accessible matrix of specific adversary tactics, techniques, and procedures based on real-world observations.

The Cyber Kill Chain methodology outlines the high-level linear phases of an attack instead of a detailed technique matrix. The Diamond Model of Intrusion focuses on analyzing relationships between adversaries, capabilities, infrastructure, and victims. The Zero Trust architecture model is an access control philosophy based on continuous verification rather than a threat intelligence framework.

The key concept tested is understanding and applying threat intelligence frameworks to evaluate defensive capabilities.

Question 3

Which step represents the final phase of the Cyber Kill Chain where adversaries accomplish their original goals?

Establishing Command and Control Executing Actions on Objectives Exploiting a known vulnerability Installing the malicious software

Correct Answer: Executing Actions on Objectives

Executing Actions on Objectives represents the final phase of the Cyber Kill Chain framework where the attacker actively achieves their primary goals, such as data exfiltration or system destruction.
Establishing Command and Control occurs earlier to allow remote manipulation of the compromised system. Installing the malicious software is a preceding phase used to maintain persistence inside the target environment. Exploiting a known vulnerability happens during the initial breach to gain unauthorized access.
The key concept tested is understanding the sequence and distinct phases of the Lockheed Martin Cyber Kill Chain.

Threat Frameworks (MITRE ATT&CK, Cyber Kill Chain)