1.3 Describe Security Terms 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is a common motivation for hacktivist threat actors?

   • AFinancial profit
   • BRevenge against a former employer
   • CPolitical or social change
   • DIntellectual challenge
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which step is typically part of the threat modeling process?

   • AConfiguring firewall rules to block malicious traffic
   • BDeploying security patches to production systems
   • CDecomposing the application to understand its components and data flows
   • DConducting a penetration test on the live system
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security operations center receives threat intelligence from multiple sources: an open-source feed, a commercial vendor, and an industry information sharing group. The intelligence contains conflicting information about the same threat actor's TTPs. The SOC manager needs to decide which intelligence to use for prioritizing defenses. Which approach is most appropriate?

   • ACorrelate the intelligence from all sources and assess each source's credibility, timeliness, and relevance to the organization's environment.
   • BUse the commercial vendor's intelligence because it is paid and therefore more reliable.
   • CUse the open-source feed because it is free and widely available.
   • DChoose the intelligence that aligns with the organization's existing security tools, regardless of source.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of threat intelligence in a security operations center?

   • ATo guarantee that no security breach will occur
   • BTo replace the need for security monitoring tools
   • CTo provide actionable information about threats to support detection and response decisions
   • DTo automatically block all network traffic from untrusted sources
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A regional bank's SOC receives daily threat intelligence feeds from a commercial vendor. The feed includes indicators of compromise (IOCs) for a new banking trojan that is targeting the bank's geographic region. The SOC manager wants to prioritize which IOCs to block at the perimeter firewall. Which approach best uses the threat intelligence to support this decision?

   • ACorrelate the IOCs with the bank's own network telemetry and asset inventory, then block only those that match the bank's environment and risk profile.
   • BForward the raw feed to the firewall vendor and ask them to implement the blocks on the bank's behalf.
   • CWait for the feed to be updated with more IOCs before taking action, to ensure the block list is comprehensive.
   • DBlock all IOCs from the feed immediately, because the vendor is reputable and the trojan is regionally relevant.
   Reveal Solution Discussion Select an answer first