nerdexam
CompTIA

PT0-002 · Question #175

Which of the following would a company's hunt team be MOST interested in seeing in a final report?

The correct answer is B. Attack TTPs. A company's hunt team is primarily focused on proactively searching for threats and needs actionable intelligence to improve detection capabilities. Attack TTPs (Tactics, Techniques, and Procedures) provide detailed information on how an attacker operated, enabling the hunt…

Reporting and Communication

Question

Which of the following would a company's hunt team be MOST interested in seeing in a final report?

Options

  • AExecutive summary
  • BAttack TTPs
  • CMethodology
  • DScope details

How the community answered

(19 responses)
  • A
    5% (1)
  • B
    84% (16)
  • D
    11% (2)

Why each option

A company's hunt team is primarily focused on proactively searching for threats and needs actionable intelligence to improve detection capabilities. Attack TTPs (Tactics, Techniques, and Procedures) provide detailed information on how an attacker operated, enabling the hunt team to develop better detection rules and improve their overall threat hunting strategies.

AExecutive summary

An executive summary provides a high-level overview for management but lacks the technical depth a hunt team requires for actionable insights to improve detection capabilities.

BAttack TTPsCorrect

A company's hunt team is responsible for proactively searching for threats that have bypassed automated security controls, and detailed Attack TTPs (Tactics, Techniques, and Procedures) describe the specific methods and behaviors an attacker used, which is invaluable for developing new detection queries, improving existing alerts, and enhancing future threat identification.

CMethodology

The methodology section describes how the penetration test was conducted, which is useful for context but does not provide the specific threat intelligence (TTPs) that a hunt team needs to improve threat detection.

DScope details

Scope details define the boundaries of the test, which is important for understanding the report's context but is not directly actionable intelligence for a hunt team trying to find threats.

Concept tested: Penetration test report content - Hunt Team

Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf

Topics

#Threat Hunting#Reporting#TTPs#Security Operations

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice