ATT&CK Threat Hunting Practice Questions - MITRE ATT&CK Threat Hunting and Detection Engineering (MAD20) Exam - ATT&CK Threat Hunting Practice Questions - MITRE ATT&CK Threat Hunting and Detection Engineering (MAD20) Exam

Question 1

Which of the following best describes the primary goal of a TTP-based threat hunt as taught in the MAD20 ATT&CK Threat Hunting methodology?

Proactively searching for adversary behaviors using ATT&CK techniques as the model of malicious activity Reactively investigating alerts generated by SIEM correlation rules Performing a vulnerability scan to identify unpatched systems Building firewall rules based on known malicious IP addresses

Correct Answer:

Proactively searching for adversary behaviors using ATT&CK techniques as the model of malicious activity

Question 2

In the MAD20 six-step TTP-based threat hunt methodology, what is the correct order of the first two steps?

Identify adversary behaviors of interest, then develop hypotheses Implement analytics, then develop hypotheses Collect data, then identify adversary behaviors Execute the hunt, then identify adversary behaviors

Correct Answer:

Identify adversary behaviors of interest, then develop hypotheses

Question 3

Which ATT&CK construct represents the 'why' behind an adversary action—the goal the adversary is trying to achieve?

Technique Procedure Tactic Sub-technique

Correct Answer:

Tactic

Question 4

A threat hunter wants to focus hunting activity on techniques most likely used by a specific threat group targeting their industry. Which ATT&CK resource directly maps known adversary groups to the techniques they have been observed using?

ATT&CK Data Sources catalog ATT&CK Navigator heat-map layers ATT&CK Groups pages ATT&CK Mitigations catalog

Correct Answer:

ATT&CK Groups pages

Question 5

When developing a threat hunt hypothesis in the MAD20 methodology, what essential element must the hypothesis contain to be actionable?

A specific, testable statement about observable adversary behavior linked to one or more ATT&CK techniques A list of SIEM alert rule IDs that currently fire A complete data-collection plan with all required log sources already confirmed available A list of CVEs associated with the suspected adversary group

Correct Answer:

A specific, testable statement about observable adversary behavior linked to one or more ATT&CK techniques

Exam overview

About this Exam

Prepare with the ATT&CK Threat Hunting Practice Questions - MITRE ATT&CK Threat Hunting and Detection Engineering (MAD20) Exam practice quiz. This question bank includes 100 questions covering threat, mad20, hunt, technique, and hunter. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

ATT&CK Threat Hunting Practice Questions - MITRE ATT&CK Threat Hunting and Detection Engineering (MAD20) Exam

This practice set contains 100 questions from the matching question bank and focuses on threat, mad20, hunt, technique, and hunter. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.

No fixed duration is currently configured for this quiz.

Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.

Yes. You can retake the practice test again as you continue studying during your available access period.

After your access is confirmed, you can continue into the complete practice exam from this quiz flow.

Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

About this Exam

Additional Information

ATT&CK Threat Hunting Practice Questions - MITRE ATT&CK Threat Hunting and Detection Engineering (MAD20) Exam

Frequently Asked Questions

Related Questions

2nd Class Power Engineering (2A1) Practice Exam

2nd Class Power Engineering 2A3 Practice Exam

2nd Class Power Engineering (2B1) Practice Exam

2nd Class Power Engineering 2B2 Practice Exam

2nd Class Power Engineering 2B3 Practice Exam

2nd Class Power Engineering 2A2 Practice Exam Guide