Question library
MITRE ATT&CK interview questions
Every question comes with the key points a strong answer covers, the mistakes that lose candidates points, and a vetted expert answer. Read them, then practise them under questioning.
2 questions matching your filters
- An endpoint alert shows that a scheduled task was created which launches a PowerShell one-liner from a user's AppData directory. Map this to MITRE ATT&CK. A mapping question with a deliberate trap: the evidence is ambiguous, and the correct answer includes saying so rather than committing to a single technique ID.
- Your CISO has seen an ATT&CK coverage heat map showing 70% of techniques as "covered" and wants to know if that means we are 70% secure. What do you say? A question about the limits of a framework, aimed at analysts senior enough to be asked to defend a metric they did not choose.
Practise these
Reading an expert answer and producing one under questioning are different skills. The simulator asks these questions, grades your answer against the same rubric you see here, and asks the follow-up an interviewer would ask next.