100+ Free ATT&CK Threat Hunting Practice Questions

Prepare for the MITRE ATT&CK Threat Hunting and Detection Engineering (MAD20) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately

Not published Pass Rate

100+ Questions

100% Free

Loading practice questions...

Same family resources

Explore More MITRE ATT&CK Defender (MAD) Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

MITRE ATT&CK Fundamentals (MAD)

Practice Questions100 questions

2026 Statistics

Key Facts: ATT&CK Threat Hunting Exam

80%

Passing Score Per Module

MAD20

6 steps

TTP Hunt Methodology Steps

MAD20

Badge-based

Certification Model

MAD20

MITRE Engenuity

Program Origin

MITRE Engenuity / MAD20

Self-paced

Assessment Format

MAD20

ATT&CK Fundamentals

Recommended Prerequisite

MAD20

MITRE Engenuity's MAD20 program teaches and certifies the six-step TTP-based threat hunting methodology: identify adversary behaviors, develop hypotheses, determine data requirements, identify and mitigate gaps, implement and test analytics via purple teaming, and conduct the hunt. The program uses a modular badge model requiring 80% per assessment.

Sample ATT&CK Threat Hunting Practice Questions

Try these sample questions to test your ATT&CK Threat Hunting exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1Which of the following best describes the primary goal of a TTP-based threat hunt as taught in the MAD20 ATT&CK Threat Hunting methodology?

A.Proactively searching for adversary behaviors using ATT&CK techniques as the model of malicious activity

B.Reactively investigating alerts generated by SIEM correlation rules

C.Performing a vulnerability scan to identify unpatched systems

D.Building firewall rules based on known malicious IP addresses

Explanation: TTP-based threat hunting is a proactive discipline that uses adversary Tactics, Techniques, and Procedures—structured within the ATT&CK framework—as the model to guide searches for malicious activity before alerts fire. It is fundamentally different from reactive alert triage because it starts from adversary behavior knowledge rather than waiting for detection systems to trigger.

2In the MAD20 six-step TTP-based threat hunt methodology, what is the correct order of the first two steps?

A.Identify adversary behaviors of interest, then develop hypotheses

B.Implement analytics, then develop hypotheses

C.Collect data, then identify adversary behaviors

D.Execute the hunt, then identify adversary behaviors

Explanation: The six-step methodology begins by identifying and prioritizing adversary behaviors from ATT&CK (step 1), followed by developing hypotheses that articulate what malicious activity would look like in the environment (step 2). Hypotheses must be grounded in specific behaviors before data requirements and analytics can be properly shaped.

3Which ATT&CK construct represents the 'why' behind an adversary action—the goal the adversary is trying to achieve?

A.Technique

B.Procedure

C.Tactic

D.Sub-technique

Explanation: In ATT&CK, Tactics represent the adversary's high-level goal or 'why'—for example, Persistence, Privilege Escalation, or Lateral Movement. Techniques describe 'how' the adversary achieves that goal. Procedures are the specific, observed implementations of a technique. Sub-techniques add granularity below the technique level.

4A threat hunter wants to focus hunting activity on techniques most likely used by a specific threat group targeting their industry. Which ATT&CK resource directly maps known adversary groups to the techniques they have been observed using?

A.ATT&CK Data Sources catalog

B.ATT&CK Navigator heat-map layers

C.ATT&CK Groups pages

D.ATT&CK Mitigations catalog

Explanation: ATT&CK Groups pages document specific tracked threat actor groups and map each group to the techniques and software they have been observed using in real intrusions. This is the primary resource for building a group-specific hunting priority list. Navigator can visualize those group layers, but the underlying data lives in the Groups pages.

5When developing a threat hunt hypothesis in the MAD20 methodology, what essential element must the hypothesis contain to be actionable?

A.A specific, testable statement about observable adversary behavior linked to one or more ATT&CK techniques

B.A list of SIEM alert rule IDs that currently fire

C.A complete data-collection plan with all required log sources already confirmed available

D.A list of CVEs associated with the suspected adversary group

Explanation: A well-formed hunt hypothesis must be a specific and testable statement that describes observable adversary behavior tied to ATT&CK technique(s). This gives the hunt a clear success criterion: you are either finding evidence of that behavior or ruling it out. Vague hypotheses lead to unfocused hunts; hypotheses based on current alerts are reactive, not proactive.

6In the MAD20 methodology, what is an 'abstract analytic'?

A.A statistical model trained on endpoint telemetry to detect anomalies

B.A vendor-specific SIEM query written in SPL or KQL

C.A technology-agnostic description of what observable evidence would confirm a hypothesis

D.A heat map in ATT&CK Navigator showing technique coverage

Explanation: An abstract analytic is a technology-agnostic statement describing what observable data would indicate that a hypothesized adversary behavior occurred. It sits between the hypothesis and the concrete rule implementation, acting as a bridge that captures the detection logic without binding it to a specific tool. This allows the logic to be translated into Splunk SPL, Sigma, EQL, or any other query language later.

7Which of the following best describes how ATT&CK 'Data Sources' are used during the data-requirements step of the threat hunting methodology?

A.They indicate which telemetry types must be collected to have visibility into a given technique

B.They specify which threat actor groups are most likely to attack the organization

C.They provide the exact SIEM query syntax for detecting a technique

D.They define the severity rating and CVSS score for each technique

Explanation: ATT&CK Data Sources catalog the telemetry types—such as Process Creation, Network Traffic, Windows Registry, or File Modification—that are required to detect a given technique. During the data-requirements step, hunters map their hypothesized techniques to these data sources to determine what must be collected and to identify gaps where required telemetry is missing.

8A hunter identifies that ATT&CK technique T1059.001 (PowerShell) requires 'Command Execution' and 'Process Creation' data components but discovers that PowerShell script block logging (Windows Event 4104) is not enabled in the environment. This situation is best described as:

A.A visibility gap

B.A false positive rate issue

C.A hypothesis failure

D.A lateral movement detection problem

Explanation: A visibility gap occurs when the telemetry required to detect a specific adversary technique is not being collected. In this case, the absence of PowerShell script block logging (Event ID 4104) means the hunter cannot see obfuscated PowerShell content, creating a blind spot for T1059.001 detections. Identifying gaps is step 4 of the six-step methodology.

9Which Sysmon Event ID captures process creation events and is commonly used as a data source for detecting ATT&CK execution techniques?

A.Sysmon Event ID 3

B.Sysmon Event ID 7

C.Sysmon Event ID 1

D.Sysmon Event ID 11

Explanation: Sysmon Event ID 1 (Process Create) captures rich process creation telemetry including the full command line, parent process, hashes, and user context. It is the primary Sysmon data source for detecting execution techniques in ATT&CK such as T1059 (Command and Scripting Interpreter) sub-techniques. Event ID 3 is Network Connection, Event ID 7 is Image Loaded, and Event ID 11 is File Created.

10A hunter forms the hypothesis: 'APT29 is using scheduled tasks for persistence in our environment.' According to the MAD20 methodology, which step comes immediately after forming this hypothesis?

A.Develop an abstract analytic describing observable evidence

B.Conduct the hunt by searching Splunk

C.Write a concrete Sigma rule

D.Purple team the technique

Explanation: After developing a hypothesis, the next step in the MAD20 methodology is to create an abstract analytic—a technology-agnostic description of what data and patterns would constitute evidence of the hypothesized behavior. This precedes defining concrete data requirements, implementing specific detection logic, and executing the hunt.

About the ATT&CK Threat Hunting Exam

The MAD20 ATT&CK Threat Hunting and Detection Engineering certification validates that practitioners can execute a six-step TTP-based threat hunt methodology using the MITRE ATT&CK framework—from hypothesis development and data gap identification through purple team validation and detection rule deployment.

Assessment

Question count not published by the exam provider

Time Limit

Self-paced per-module assessments; no fixed time limit published

Passing Score

80% per module

Exam Fee

Subscription-based; see mad20.io for current pricing (MAD20 (MITRE Engenuity))

ATT&CK Threat Hunting Exam Content Outline

~17%

Threat Hunting Fundamentals

TTP-based vs. IoC-based hunting, ATT&CK as a behavioral model, six-step methodology structure, and hunting vs. continuous monitoring

~17%

Developing Hypotheses and Abstract Analytics

Writing testable ATT&CK-grounded hypotheses, CTI-to-technique mapping, abstract analytic formulation, and information needs

~17%

Data Collection Requirements and Gap Identification

ATT&CK data sources and components, visibility gap identification, Navigator coverage analysis, and gap remediation strategies

~17%

Testing and Tuning Analytics via Purple Teaming

Sigma rule structure, adversary emulation (Atomic Red Team, CALDERA), precision/recall optimization, and Time-Terrain-Behavior tuning

~17%

Conducting the Threat-Informed Hunt

Hunt execution, finding investigation, null result interpretation, lateral movement scope assessment, and IR handoff documentation

~15%

Detection Engineering and Operationalization

Hunt-to-SIEM promotion, detection feedback loops, playbook development, and continuous monitoring improvement

How to Pass the ATT&CK Threat Hunting Exam

What You Need to Know

Passing score: 80% per module
Assessment: Question count not published by the exam provider
Time limit: Self-paced per-module assessments; no fixed time limit published
Exam fee: Subscription-based; see mad20.io for current pricing

Keys to Passing

Work through all 100 available questions
Review every answer and explanation
Track weak areas and revisit them
Use our AI tutor for tough concepts

ATT&CK Threat Hunting Study Tips from Top Performers

1Master ATT&CK framework navigation—especially technique pages, data sources, groups, and procedures—before starting the Threat Hunting course

2Practice forming ATT&CK-grounded hypotheses: each hypothesis should name a technique, describe observable behavior, and specify terrain scope

3Learn Sigma rule YAML structure: logsource, detection (selection/filter), and condition blocks; practice reading existing Sigma rules on GitHub

4Use ATT&CK Navigator to layer threat group profiles against your simulated detection coverage to identify hunting priorities

5Understand the distinction between abstract analytics (technology-agnostic) and concrete analytics (SPL/EQL/KQL/Sigma)

6Know key Windows event IDs for common techniques: 4688/Sysmon-1 (process), 4624/4625 (auth), 4662 (object access), 4769 (Kerberos TGS), 7045 (service install)

Frequently Asked Questions

What is the MAD20 ATT&CK Threat Hunting certification?

The MAD20 ATT&CK Threat Hunting and Detection Engineering certification is issued by MAD20 (spun out of MITRE Engenuity's ATT&CK Defender program). It validates a practitioner's ability to execute a six-step TTP-based threat hunt methodology using the MITRE ATT&CK framework, from developing hypotheses through converting validated analytics into production detection rules.

What is the six-step TTP-based threat hunting methodology?

The MAD20 six-step methodology is: (1) Characterize adversary behaviors of interest using ATT&CK, (2) Develop hypotheses and abstract analytics, (3) Determine data collection requirements, (4) Identify and mitigate data collection gaps, (5) Implement and test analytics via purple teaming, and (6) Conduct the hunt and investigate findings.

What prerequisites are recommended for this certification?

MAD20 recommends solid understanding of the ATT&CK framework (the MAD20 ATT&CK Fundamentals course is strongly recommended as a prerequisite), along with familiarity with Windows operating systems, Splunk or Elastic SIEM, and networking fundamentals. Hands-on blue team or SOC experience significantly accelerates preparation.

How does the MAD20 certification assessment work?

MAD20 uses a modular badge model. Learners complete the training for each module, then take a per-module assessment. Passing each assessment at 80% or higher earns the corresponding badge. Earning all required module badges grants the full Threat Hunting and Detection Engineering certification.

What is an 'abstract analytic' in the MAD20 methodology?

An abstract analytic is a technology-agnostic description of what observable evidence would confirm a hunt hypothesis. It captures the detection logic in plain language before it is translated into a specific SIEM query language like Splunk SPL, Elastic EQL, or the platform-neutral Sigma format. Abstract analytics bridge the hypothesis and the deployable detection rule.

What is the Time-Terrain-Behavior tuning model?

The Time-Terrain-Behavior model is the MAD20 framework for optimizing detection analytic precision and recall. Time refers to temporal parameters (hours of day, frequency, duration). Terrain refers to the environmental scope (specific hosts, segments, user roles). Behavior refers to the specific observable attributes of the adversary action (command-line arguments, process paths). Adjusting these three dimensions reduces false positives without sacrificing detection capability.