A penetration tester is explaining the MITRE ATT&CK framework to a company's chief legal counsel. Which of the following would the tester MOST likely describe as a benefit of the framework?

The correct answer is A. Understanding the tactics of a security intrusion can help disrupt them. The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a curated knowledge base of real-world adversary tactics and techniques. Its primary benefit is enabling defenders and security teams to understand how attackers operate at each stage of an…

Attacks and Exploits

Question

A penetration tester is explaining the MITRE ATT&CK framework to a company’s chief legal counsel. Which of the following would the tester MOST likely describe as a benefit of the framework?

Exhibit

Options

AUnderstanding the tactics of a security intrusion can help disrupt them.
BScripts that are part of the framework can be imported directly into SIEM tools.
CThe methodology can be used to estimate the cost of an incident better.
DThe framework is static and ensures stability of a security program over time.

How the community answered

(14 responses)

A
93% (13)
B
7% (1)

Explanation

The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a curated knowledge base of real-world adversary tactics and techniques. Its primary benefit is enabling defenders and security teams to understand how attackers operate at each stage of an intrusion, which allows them to implement targeted mitigations and disrupt attacks. For a legal audience, this translates to a structured, evidence-based approach to improving defenses. ATT&CK does not include importable scripts for SIEMs (B), is not a cost-estimation tool (C), and is regularly updated - not static (D).

Topics

#MITRE ATT&CK#Adversary Tactics#Threat Intelligence#Security Frameworks

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice