Which of the following is a tactic used by attackers, rather than a technique?

Question

Options

• AGathering information about a target.
• BEstablishing persistence with a scheduled task.
• CUsing a phishing email to gain initial access.
• DEscalating privileges via UAC bypass.

• A
  77% (44)
• B
  4% (2)
• C
  7% (4)
• D
  12% (7)

Explanation

Option A is correct because "gathering information about a target" describes Reconnaissance - a high-level adversarial goal or objective, which is what a tactic represents in frameworks like MITRE ATT&CK. Tactics answer "what is the attacker trying to achieve?", not "how are they doing it?"

Options B, C, and D are all techniques because each describes a specific method used to accomplish a tactic:

• B uses a scheduled task to achieve the tactic of Persistence.
• C uses a phishing email to achieve the tactic of Initial Access.
• D uses a UAC bypass to achieve the tactic of Privilege Escalation.

Memory tip: Think of it as Tactic = Target, Technique = Tool. Tactics are broad objectives an attacker pursues (recon, persistence, exfiltration); techniques are the concrete mechanisms they employ to get there. If the answer names a specific mechanism or tool ("phishing," "UAC bypass," "scheduled task"), it's a technique - not a tactic.

No community discussion yet for this question.