Exam CS0-002 topic 1 question 63 discussion

I just took the exam and MITRE ATT&CK wasn't an option so it's A.

There are many keys words that point tp this answer being kill chain. (attack phases , incidents are linked) Chegg has wrong answers all the time ATT&CK Tactics are unordered and may not all occur in a single intrusion because adversary tactical goals change throughout an operation, whereas the Cyber Kill Chain uses ordered phases to describe high-level adversary objectives

Incident Linkage: Comparing ATT&CK patterns across multiple incidents can help determine if they are related, sharing similar tactics or tools.

Mitre ATT&CK

B. The MITRE ATT&CK framework The MITRE ATT&CK framework provides a comprehensive and detailed mapping of tactics, techniques, and procedures (TTPs) used by adversaries during different stages of the attack lifecycle. It covers a wide range of cybersecurity areas and is widely used for threat intelligence analysis. The framework helps security analysts understand the tactics employed by attackers, making it easier to identify patterns, similarities, and potential links between different incidents. While the Cyber Kill Chain, adversary capability models, and the Diamond Model of Intrusion Analysis are valuable in their own right, the MITRE ATT&CK framework is specifically designed to provide a detailed and structured approach to understanding and analyzing cyber threats.

The MITRE ATT&CK framework is a knowledge base that describes the actions and tactics commonly observed in cyber threats. It covers a wide range of techniques used by adversaries, including the attack phases.

Given Answer is correct. From Daril Gibson Study guide: The model is intended to help analysts discover more information by highlighting the relationship between elements by following the edges between the events.

The MITRE ATT&CK framework is a widely recognized and comprehensive knowledge base of adversary tactics, techniques, and procedures (TTPs). It provides a standardized taxonomy of cyber threats, organized into various phases and categories, which can be used to analyze and understand the attack lifecycle. The framework covers the entire spectrum of cyber threats, including both traditional and advanced persistent threats (APTs).

Wouldn't ATT&CK Tactics link threat actors from past attacks? based off behaviors?

The Cyber Kill Chain can help identify the stages of a cyber attack and provide insight into the tactics and techniques used by adversaries. However, it may not be the most effective method for identifying whether or not incidents are linked. The MITRE ATT&CK framework can help identify whether or not incidents are linked. The framework includes information on the tactics and techniques used by adversaries, and organizations can use this information to identify patterns and similarities between different incidents. To determine whether or not incidents are linked using the Cyber Kill Chain model, an analyst would need to compare the different stages of each incident and look for similarities. Overall, while the Cyber Kill Chain model can provide some insight into the different stages of a cyber attack, the MITRE ATT&CK framework is a more comprehensive resource for identifying and analyzing cyber threats, including determining whether or not incidents are linked.

A. Keywords "Attack Phase.."

The question is asking about the phases of the attack, which would use the Cyber Kill chain. MITRE ATT&CK doesn't use phases and isn't linear analysis and is more focused on the techniques. Diamond also does not use phases and is more focused on connecting the components of the attack.

While the Diamond Model is difficult to apply to manual "pen and paper" analysis, it has been used to develop automated threat intelligence analysis engines. Official Cysa+ Course Material.

I taked from book; Events can be linked into attack graphs and activity threads, graphed along each vertex,representing the paths an adversary could take (if analyzing an attack in progress) andthose that were taken (if analyzing past activity). i going with D with confidenttaly.

I taked from book; Events can be linked into attack graphs and activity threads, graphed along each vertex,representing the paths an adversary could take (if analyzing an attack in progress) andthose that were taken (if analyzing past activity). i going with D with confidenttaly.

The most appropriate method to use in this scenario would be B. The MITRE ATT&CK framework. The MITRE ATT&CK framework is a comprehensive knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations of cyber-attacks. The framework provides a common language and understanding for security teams to discuss and identify the different phases of an attack, helping them to detect and respond to threats effectively. The framework is regularly updated and includes information on the latest incidents and attack techniques. While the other options listed - A. The Cyber Kill Chain, C. An adversary capability model, and D. The Diamond Model of Intrusion Analysis - are also useful in analyzing and understanding cyber incidents, the MITRE ATT&CK framework is the most appropriate for identifying whether or not incidents are linked, as it includes a vast amount of information on TTPs that can be used to identify patterns and similarities between attacks.

Most suitable answer would be A, due to phases.