According to the MITRE ATT&CK framework, which approach should be used to mitigate exploitation risks?

Question

Options

• APerforming regular data backups and testing recovery procedures
• BKeeping systems updated with the latest patches
• CConsistently maintaining up-to-date antivirus software
• DEnsuring that network traffic is closely monitored and controlled

• A
  7% (3)
• B
  88% (36)
• C
  2% (1)
• D
  2% (1)

Explanation

Keeping systems patched (B) directly eliminates the vulnerabilities that exploitation techniques depend on. Within the MITRE ATT&CK framework, M1051 (Update Software) is the primary mitigation mapped against exploitation techniques such as T1190 (Exploit Public-Facing Application) and T1203 (Exploitation for Client Execution) - patching removes the attack surface itself, whereas the other options address different phases of defense.

Why the distractors are wrong:

• A (data backups) addresses recovery after an incident, not prevention of exploitation - it's a resilience control, not a mitigation control.
• C (antivirus software) is a detection/signature-based layer that attackers can evade with novel or obfuscated exploits; ATT&CK mitigations prioritize eliminating vulnerabilities over detecting their abuse.
• D (network monitoring) is a detective control - it may catch exploitation in progress but does nothing to prevent the underlying vulnerability from being exploitable.

Memory tip: Think "patch = close the door before the burglar arrives." Exploitation only works when a vulnerability exists; patching is the only option here that removes that vulnerability entirely, which is why ATT&CK lists it as the direct mitigation.

No community discussion yet for this question.