Exam CAS-005 topic 1 question 26 discussion

🔍 Why the Others Are Less Appropriate: A. Tabletop exercise Simulates incident response in a discussion-based format — no real testing of controls or detection capabilities. C. Sandbox detonation Tests how malware behaves in a safe environment — useful for analyzing malicious files, not TTP-based detection across the network. D. Honeypot Lures attackers for monitoring, but passive and not suited for systematic, targeted testing based on a known framework like MITRE ATT&CK.

To test and verify capabilities to detect and/or prevent specific TTPs (Tactics, Techniques, and Procedures) from the MITRE ATT&CK framework — especially those used by Advanced Persistent Threats (APTs) — an organization needs a realistic, controlled simulation of attacks. A penetration test (or more specifically, a red team engagement) can be tailored to emulate adversary behavior mapped directly to the MITRE ATT&CK framework. This allows the organization to: Actively test defenses against known APT TTPs. Identify detection gaps and improve response. Measure how well existing security controls and processes perform.