FCSS_SOC Question 8

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B0

  ,C - Understanding the MITRE ATT&CK Matrix: The MITRE ATT&CK framework is a knowledge base of adversary tactics and techniques based on real-world observations. Each tactic in the matrix represents the "why" of an attack technique, while each technique represents "how" an adversary achieves a tactic. Analyzing the Provided Exhibit: The exhibit shows part of the MITRE ATT&CK Enterprise matrix as displayed on FortiAnalyzer. The focus is on technique T1071 (Application Layer Protocol), which has subtechniques labeled T1071.001, T1071.002, T1071.003, and T1071.004. Each subtechnique specifies a different type of application layer protocol used for Command and Control (C2): T1071.001 Web Protocols T1071.002 File Transfer Protocols T1071.003 Mail Protocols T1071.004 DNS Identifying Key Points: Subtechniques under T1071: There are four subtechniques listed under the primary technique T1071, confirming that statement B is true. Event Handlers for T1071: FortiAnalyzer includes event handlers for monitoring various tactics and techniques. The presence of event handlers for tactic T1071 suggests active monitoring and alerting for these specific subtechniques, confirming that statement C is true. Misconceptions Clarified: Statement A (four techniques under tactic T1071) is incorrect because T1071 is a single technique with four subtechniques. Statement D (15 events associated with the tactic) is misleading. The number 15 refers to the techniques under the Application Layer Protocol, not directly related to the number of events. Conclusion: The accurate interpretation of the exhibit confirms that there are four subtechniques under technique T1071 and that there are event handlers covering tactic T1071. Reference: MITRE ATT&CK Framework documentation. FortiAnalyzer Event Handling and MITRE ATT&CK Integration guides.