Question 310 The legal practice SOC needs to distinguish an adversary's objective from its implementation method in a detection report, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Detection validation requires actual signal evidence, not only a matching title. A tactic describes why while a technique describes how the adversary acts. NRT rules evaluate on a shorter defined cadence than many scheduled queries. Technique-specific telemetry yields a testable detection requirement. Explanation Correct Answer B:A tactic describes why while a technique describes how the adversary acts. Incorrect Answers A:Validating a proposed new rule against realistic attacker behavior rather than a keyword match does not distinguish an adversary's objective from its implementation method in a detection report. C:Identifying immediately arriving high-value events with near-real-time evaluation where supported does not distinguish an adversary's objective from its implementation method in a detection report. D:Prioritizing a missed credential-access behavior with strong endpoint evidence does not distinguish an adversary's objective from its implementation method in a detection report.
Question 311 A report labels “credential access” as the precise implementation technique, although the evidence is an LSASS memory attempt. Which explanation best accounts for the specific failure? The analyst mapped a general sign-in signal to a separate credential-access technique without endpoint evidence The proposed rule has not been validated against representative ingested technique telemetry The report conflates a broad ATT&CK tactic with a specific technique and supporting procedure The selected analytics rule type or run frequency does not provide the intended near-real-time evaluation Explanation Correct Answer C:The report conflates a broad ATT&CK tactic with a specific technique and supporting procedure. Incorrect Answers A:The analyst mapped a general sign-in signal to a separate credential-access technique without endpoint evidence; the report conflates a broad ATT&CK tactic with a specific technique and supporting procedure. B:The proposed rule has not been validated against representative ingested technique telemetry; the report conflates a broad ATT&CK tactic with a specific technique and supporting procedure. D:The selected analytics rule type or run frequency does not provide the intended near-real-time evaluation; the report conflates a broad ATT&CK tactic with a specific technique and supporting procedure.
Question 312 During a controlled investigation, an analyst maps a credential-theft alert to the ATT&CK framework. Which observation most directly verifies the intended technical behavior? A matching endpoint technique detection fires with the attack trace and an appropriate ATT&CK mapping The record separately identifies the Credential Access tactic and an appropriate specific technique supported by observed telemetry The analytic rule matches the expected events with documented false-positive checks, not only a matching keyword The configured near-real-time rule generates the expected alert at its supported evaluation cadence Explanation Correct Answer B:The record separately identifies the Credential Access tactic and an appropriate specific technique supported by observed telemetry. Incorrect Answers A:A matching endpoint technique detection fires with the attack trace and an appropriate ATT&CK mapping; the record separately identifies the Credential Access tactic and an appropriate specific technique supported by observed telemetry. C:The analytic rule matches the expected events with documented false-positive checks, not only a matching keyword; the record separately identifies the Credential Access tactic and an appropriate specific technique supported by observed telemetry. D:The configured near-real-time rule generates the expected alert at its supported evaluation cadence; the record separately identifies the Credential Access tactic and an appropriate specific technique supported by observed telemetry.
Question 313 A insurance provider needs to prioritize a missed credential-access behavior with strong endpoint evidence. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Evaluate a supported Sentinel machine-learning or fusion detection approach Perform controlled testing or replay of representative technique telemetry Select a relevant ATT&CK credential access technique and build a source-aligned analytic Map the high-level tactic separately from the concrete ATT&CK technique Explanation Correct Answer C:Technique-specific telemetry yields a testable detection requirement. Incorrect Answers A:Behavioral correlation can combine distinct signals rather than a single static equality predicate. B:Detection validation requires actual signal evidence, not only a matching title. D:A tactic describes why while a technique describes how the adversary acts.
Question 314 The hospital SOC SOC needs to prioritize a missed credential-access behavior with strong endpoint evidence, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Technique-specific telemetry yields a testable detection requirement. Scheduled rules query data over configured execution windows. A tactic describes why while a technique describes how the adversary acts. Detection validation requires actual signal evidence, not only a matching title. Explanation Correct Answer A:Technique-specific telemetry yields a testable detection requirement. Incorrect Answers B:Running a KQL rule on a configurable interval and lookback schedule does not prioritize a missed credential-access behavior with strong endpoint evidence. C:Distinguishing an adversary's objective from its implementation method in a detection report does not prioritize a missed credential-access behavior with strong endpoint evidence. D:Validating a proposed new rule against realistic attacker behavior rather than a keyword match does not prioritize a missed credential-access behavior with strong endpoint evidence.
Question 315 The coverage report says credential theft is detected because a login anomaly rule exists, but no endpoint rule detects the known LSASS technique. Which explanation best accounts for the specific failure? The report conflates a broad ATT&CK tactic with a specific technique and supporting procedure The proposed rule has not been validated against representative ingested technique telemetry The detection lacks the actual threat-indicator matching logic or correct source correlation The analyst mapped a general sign-in signal to a separate credential-access technique without endpoint evidence Explanation Correct Answer D:The analyst mapped a general sign-in signal to a separate credential-access technique without endpoint evidence. Incorrect Answers A:The report conflates a broad ATT&CK tactic with a specific technique and supporting procedure; the analyst mapped a general sign-in signal to a separate credential-access technique without endpoint evidence. B:The proposed rule has not been validated against representative ingested technique telemetry; the analyst mapped a general sign-in signal to a separate credential-access technique without endpoint evidence. C:The detection lacks the actual threat-indicator matching logic or correct source correlation; the analyst mapped a general sign-in signal to a separate credential-access technique without endpoint evidence.
Question 316 During a controlled investigation, a controlled credential-access simulation is run against a monitored workstation. Which observation most directly verifies the intended technical behavior? The record separately identifies the Credential Access tactic and an appropriate specific technique supported by observed telemetry A matching endpoint technique detection fires with the attack trace and an appropriate ATT&CK mapping The analytic rule matches the expected events with documented false-positive checks, not only a matching keyword The indicator-matching analytic produces an alert carrying the matching observed IP and indicator context Explanation Correct Answer B:A matching endpoint technique detection fires with the attack trace and an appropriate ATT&CK mapping. Incorrect Answers A:The record separately identifies the Credential Access tactic and an appropriate specific technique supported by observed telemetry; a matching endpoint technique detection fires with the attack trace and an appropriate ATT&CK mapping. C:The analytic rule matches the expected events with documented false-positive checks, not only a matching keyword; a matching endpoint technique detection fires with the attack trace and an appropriate ATT&CK mapping. D:The indicator-matching analytic produces an alert carrying the matching observed IP and indicator context; a matching endpoint technique detection fires with the attack trace and an appropriate ATT&CK mapping.
Question 317 A regional SOC needs to validate a proposed new rule against realistic attacker behavior rather than a keyword match. Its current security configuration cannot meet this specific operational requirement. Which action should the SOC implement? Select a relevant ATT&CK credential access technique and build a source-aligned analytic Perform controlled testing or replay of representative technique telemetry Map the high-level tactic separately from the concrete ATT&CK technique Create a Microsoft Defender XDR custom detection rule using the validated hunting query Explanation Correct Answer B:Detection validation requires actual signal evidence, not only a matching title. Incorrect Answers A:Technique-specific telemetry yields a testable detection requirement. C:A tactic describes why while a technique describes how the adversary acts. D:Custom detection rules convert query matches into alerts and permitted responses.
Question 318 The telecom provider SOC needs to validate a proposed new rule against realistic attacker behavior rather than a keyword match, and its change advisory board asks for the technical basis of the recommended method. Which explanation identifies the most relevant capability? Detection validation requires actual signal evidence, not only a matching title. Technique-specific telemetry yields a testable detection requirement. TI rules correlate observed indicators against intelligence data. A tactic describes why while a technique describes how the adversary acts. Explanation Correct Answer A:Detection validation requires actual signal evidence, not only a matching title. Incorrect Answers B:Prioritizing a missed credential-access behavior with strong endpoint evidence does not validate a proposed new rule against realistic attacker behavior rather than a keyword match. C:Detecting matches to known threat indicators with relevant telemetry does not validate a proposed new rule against realistic attacker behavior rather than a keyword match. D:Distinguishing an adversary's objective from its implementation method in a detection report does not validate a proposed new rule against realistic attacker behavior rather than a keyword match.
Question 319 A new analytic rule looks correct on paper but raises no alert during a known technique replay; the test telemetry is absent from its query input. Which explanation best accounts for the specific failure? The report conflates a broad ATT&CK tactic with a specific technique and supporting procedure The analyst mapped a general sign-in signal to a separate credential-access technique without endpoint evidence A supported multi-signal machine-learning detector requires corroborating evidence; one weak event cannot guarantee fusion The proposed rule has not been validated against representative ingested technique telemetry Explanation Correct Answer D:The proposed rule has not been validated against representative ingested technique telemetry. Incorrect Answers A:The report conflates a broad ATT&CK tactic with a specific technique and supporting procedure; the proposed rule has not been validated against representative ingested technique telemetry. B:The analyst mapped a general sign-in signal to a separate credential-access technique without endpoint evidence; the proposed rule has not been validated against representative ingested technique telemetry. C:A supported multi-signal machine-learning detector requires corroborating evidence; one weak event cannot guarantee fusion; the proposed rule has not been validated against representative ingested technique telemetry.
Question 320 During a controlled investigation, a controlled attacker-behavior replay generates recognizable supported logs. Which observation most directly verifies the intended technical behavior? The record separately identifies the Credential Access tactic and an appropriate specific technique supported by observed telemetry A matching endpoint technique detection fires with the attack trace and an appropriate ATT&CK mapping A supported fusion/correlated incident groups relevant cross-signal evidence rather than creating it from one unrelated record The analytic rule matches the expected events with documented false-positive checks, not only a matching keyword Explanation Correct Answer D:The analytic rule matches the expected events with documented false-positive checks, not only a matching keyword. Incorrect Answers A:The record separately identifies the Credential Access tactic and an appropriate specific technique supported by observed telemetry; the analytic rule matches the expected events with documented false-positive checks, not only a matching keyword. B:A matching endpoint technique detection fires with the attack trace and an appropriate ATT&CK mapping; the analytic rule matches the expected events with documented false-positive checks, not only a matching keyword. C:A supported fusion/correlated incident groups relevant cross-signal evidence rather than creating it from one unrelated record; the analytic rule matches the expected events with documented false-positive checks, not only a matching keyword.
