Attack Frameworks (CySA+): MITRE ATT&CK vs Kill Chain

1. The Cyber Kill Chain's 'Command and Control' phase corresponds most closely to which MITRE ATT&CK tactic?

Execution

Command and Control

Exfiltration

Defense Evasion

Submit

3. Which framework is more commonly used for mapping threat intelligence findings and incident response?

Cyber Kill Chain

MITRE ATT&CK

Both equally in practice

Neither is used operationally

4. MITRE ATT&CK is organized into multiple matrices based on target platforms. Which is NOT a MITRE matrix?

Enterprise

Mobile

Automotive

Industrial Control Systems

5. The Cyber Kill Chain's 'Delivery' phase is most similar to which MITRE tactic?

Initial Access

Execution

Persistence

Privilege Escalation

Submit

7. Which statement best describes a key difference between the two frameworks?

Kill Chain is for defenders; ATT&CK is for attackers

ATT&CK provides granular tactics; Kill Chain describes linear phases

Kill Chain covers only malware; ATT&CK covers all threats

ATT&CK is outdated; Kill Chain is current

8. MITRE ATT&CK groups are adversaries tracked and documented with which type of identifier?

CVE numbers

Group IDs (G####)

Kill Chain stages

CVSS scores

Submit

10. Which framework includes sub-techniques alongside its main techniques?

Cyber Kill Chain only

MITRE ATT&CK only

Both equally

Neither framework

11. Which framework was developed by Lockheed Martin to describe the stages of a cyber attack?

MITRE ATT&CK

Cyber Kill Chain

NIST Cybersecurity Framework

Diamond Model of Intrusion Analysis

12. In MITRE ATT&CK, 'Initial Access' is a tactic that describes techniques for gaining entry. Which of these is an Initial Access technique?

Phishing

Credential Dumping

Data Staged

Process Injection

13. Which framework is matrix-based and organized by adversary groups, software, and campaigns?

Cyber Kill Chain

MITRE ATT&CK

PTES

OWASP Top 10

Submit

15. MITRE ATT&CK is primarily designed to help organizations understand which of the following?

Vulnerability management

Adversary tactics and techniques

Network topology

Firewall rule configuration

16. In the Cyber Kill Chain, which phase includes crafting malware or exploits?

Reconnaissance

Weaponization

Exploitation

Actions on Objectives

Submit

18. Which phase of the Cyber Kill Chain involves the attacker researching the target?

Delivery

Reconnaissance

Exploitation

Installation

19. The Cyber Kill Chain consists of how many primary phases?

5

7

9

11

20. MITRE ATT&CK is organized into tactics and techniques. Which of these is a MITRE tactic?

Reconnaissance

Weaponization

Persistence

Command and Control

Framework Quiz: MITRE ATT&CK or Cyber Kill Chain?

1. The Cyber Kill Chain's 'Command and Control' phase corresponds most closely to which MITRE ATT&CK tactic?

2.

What first name or nickname would you like us to use?

2. The first phase of the Cyber Kill Chain, _____, involves passive information gathering about the target.

3. Which framework is more commonly used for mapping threat intelligence findings and incident response?

4. MITRE ATT&CK is organized into multiple matrices based on target platforms. Which is NOT a MITRE matrix?

5. The Cyber Kill Chain's 'Delivery' phase is most similar to which MITRE tactic?

6. In MITRE ATT&CK, the tactic 'Persistence' includes techniques that allow an attacker to _____ access to a compromised system.

7. Which statement best describes a key difference between the two frameworks?

8. MITRE ATT&CK groups are adversaries tracked and documented with which type of identifier?

9. The Cyber Kill Chain was updated in 2013 to include an additional phase called _____ between Command and Control and Actions on Objectives.

10. Which framework includes sub-techniques alongside its main techniques?

11. Which framework was developed by Lockheed Martin to describe the stages of a cyber attack?

12. In MITRE ATT&CK, 'Initial Access' is a tactic that describes techniques for gaining entry. Which of these is an Initial Access technique?

13. Which framework is matrix-based and organized by adversary groups, software, and campaigns?

14. The Cyber Kill Chain phase _____ involves establishing persistent access to the target system.

15. MITRE ATT&CK is primarily designed to help organizations understand which of the following?

16. In the Cyber Kill Chain, which phase includes crafting malware or exploits?

17. MITRE ATT&CK uses the term _____ to describe specific ways an adversary achieves a tactic.

18. Which phase of the Cyber Kill Chain involves the attacker researching the target?

19. The Cyber Kill Chain consists of how many primary phases?

20. MITRE ATT&CK is organized into tactics and techniques. Which of these is a MITRE tactic?