Refer to the exhibit, which shows the partial output of the MITRE ATT&CK Enterprise matrix on FortiAnalyzer. Which two statements are true? (Choose two.)

The correct answer is B. There are four subtechniques that fall under technique T1071. C. There are event handlers that cover tactic T1071. You can see four sub‑techniques under T1071 (T1071.001 through T1071.004). The presence of counts next to T1071 and its sub‑techniques indicates that FortiAnalyzer's event handlers are mapped to - and thus cover - those ATT&CK entries.

FortiAnalyzer for SOC

Question

Exhibit

Options

AThere are four techniques that fall under tactic T1071.
BThere are four subtechniques that fall under technique T1071.
CThere are event handlers that cover tactic T1071.
DThere are 15 events associated with the tactic.

How the community answered

(28 responses)

A
32% (9)
B
50% (14)
D
18% (5)

Explanation

You can see four sub‑techniques under T1071 (T1071.001 through T1071.004). The presence of counts next to T1071 and its sub‑techniques indicates that FortiAnalyzer's event handlers are mapped to - and thus cover - those ATT&CK entries.

Topics

#MITRE ATT&CK#T1071#subtechniques#event handlers

Community Discussion

No community discussion yet for this question.

Full NSE7_SOC_AR-7.6 Practice