MITRE ATTACK Framework Questions

Comprehensive knowledge of the MITRE ATTACK knowledge base, including the matrix of adversary tactics, techniques, and sub techniques. Candidates should understand the full lifecycle of adversary behavior such as reconnaissance, resource development, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, and impact. Skills assessed include mapping real world incidents to ATTACK techniques and technique identifiers, profiling adversary types and campaigns, using ATTACK to design realistic penetration tests and red team exercises, and planning purple team and threat hunting activities. Also important is the ability to translate ATTACK mappings into detection hypotheses and telemetry requirements, recommend mitigations and compensating controls, and communicate findings to technical and non technical stakeholders for incident response and security engineering improvements.