338 questions with instant explanations, domain breakdown, and wrong-answer analysis. Built for the real exam.
This is exactly what you see during practice — question, options, and a full explanation after you answer.
You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?
File and Directory Discovery often involves listing files, which generates audit events when monitoring directory access via Sysmon Event ID 11 or Windows Security logs.
While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?
Modifying registry run keys is a standard technique to ensure a program executes automatically upon system startup, which defines Persistence.
You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?
The spawning of a command shell from a remote management process is a classic indicator of Lateral Movement using remote execution.
Questions are tagged by exam domain. Practice a specific domain or mix them all.
Answer at your own pace. Explanation and domain tag shown immediately after each answer.
Countdown timer starts immediately. Results and domain scores shown at the end — just like the real exam.
Full explanations on every question
Not just the right answer — you get exactly why each wrong option is wrong, so you learn the concept, not the answer.
Domain score breakdown
After each session see your score by exam domain so you know exactly where to focus study time.
100% free, forever
No subscription, no trial, no email wall. Start a session in under 10 seconds.
Exam-style questions
Scenario-based, precise wording, realistic distractors — written to match what you actually see on exam day.