macOS · Expert

MITRE ATT&CK SOC Analyst Quiz

Section 3: macOS — Expert (Questions 41–60)

For every question, you must type in the correct MITRE ATT&CK tactic and technique yourself — there are no multiple-choice options for these fields. Use the ATT&CK Navigator to look them up.

How to Answer Each Question

For each scenario, answer 5 components:

  1. Strategic objective — Campaign goal, not just the immediate action.
  2. MITRE ATT&CK Tactic — Type the primary tactic. No multiple-choice — use the ATT&CK framework.
  3. Technique / Sub-technique — Type the technique ID and name. No multiple-choice — look it up in the framework.
  4. Key evidence — Artifacts that support your mapping.
  5. Next likely step — Attacker’s next move or blue-team response.

At this tier, incorrect confident mappings are penalized; “uncertain but reasoning toward X” is scored more favorably than a wrong definitive answer.

Scoring

ComponentPoints
Strategic Objective1 point
Correct Tactic2 points
Correct Technique + ID3 points
Evidence Analysis2 points
Next Likely Step2 points

Maximum: 200 points (10 per question × 20 questions)