FirstTry

Objective 3.1

CS0-003

Explain concepts related to attack methodology frameworks.

Objective 3.1 sits in Incident Response and Management, which carries 20% of the CySA+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.

Objective title verbatim from the official objectives. CompTIA exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

3-1Incident Response and Management

You are mapping an intrusion report to ATT&CK and must place each observed action under both a tactic and a technique. What separates the two?

Tactics are tools, techniques are groupsTools and groups are separate ATT&CK objects, not this distinction.
Tactics are why, techniques are howCorrect · your answerCorrect: tactics are the adversary's why, techniques the how.
Tactics are hosts, techniques are networksNeither term describes a host or network split.
They are interchangeable labelsThe model keeps them distinct; each technique sits under a tactic.

Correct.

Checked against attack.mitre.org, August 2026

Concept

The model separates an adversary's goal from the method used to reach it, so one goal can map to many methods and detections can target either layer.

Why B

ATT&CK defines tactics as the why, the reason an adversary performs an action, and techniques as the how, the way tactical goals are achieved by performing an action.

Source

Tactics, represents “why” or the reason an adversary is performing an action Techniques, represents “how” adversaries achieve tactical goals by performing an action…

MITRE ATT&CK, Get Started, checked August 2026
#attack#frameworks#methodology

Now you: objective 3.1 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

3-1Incident Response and Management

A new SOC hire is handed an ATT&CK Navigator layer showing which techniques the team can detect today. What is MITRE ATT&CK?

Sample question 2 of 3

3-1Incident Response and Management

An analyst reads a CTI report describing the exact command line a group used to run a scheduled task. In ATT&CK terms, what is that detail?

Sample question 3 of 3

3-1Incident Response and Management

An OT team wants ATT&CK coverage for the PLCs on a plant floor as well as for the corporate laptops and phones. Which technology domains does ATT&CK currently cover?

Full CySA+ question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Incident Response and Management