Cyber Threat Trends and Challenges TIE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A mid-sized healthcare organization is updating its security strategy. It faces a rising number of ransomware attacks in its sector, but its security team is small and lacks deep threat-hunting skills. The organization must maintain compliance with patient-data regulations and cannot afford a large increase in operational costs. Which strategy best balances these constraints?

   • AImplement a robust backup and disaster recovery plan and rely on restoring systems after a ransomware attack.
   • BOutsource threat monitoring and incident response to a managed security service provider (MSSP) that provides 24/7 coverage and expertise.
   • CPurchase a commercial threat intelligence platform and assign the existing team to manually review daily reports and hunt for indicators.
   • DIncrease the security team's budget to hire additional threat hunters with specialized ransomware expertise.
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   Which of the following best describes a current trend in cyber threats that has been increasingly observed in recent years?

   • ACybercriminals now focus exclusively on cloud infrastructure, abandoning on-premises targets.
   • BRansomware-as-a-service (RaaS) has lowered the technical barrier, enabling less-skilled criminals to launch sophisticated ransomware campaigns.
   • CPhishing has become obsolete because of improved email security gateways.
   • DAttackers are shifting from financially motivated attacks to purely destructive wiper malware.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A large enterprise is experiencing an increase in insider threat incidents, including accidental data exposure and malicious data exfiltration. The company has a high turnover rate and many employees have access to sensitive data. The security team is considering implementing user and entity behavior analytics (UEBA), data loss prevention (DLP), or stricter access controls. The company wants to minimize disruption to productivity. Which approach would best balance security and productivity?

   • ARevoke access to sensitive data for all employees and require manager approval for every access request.
   • BMonitor all employee email and instant messaging communications for keywords related to data exfiltration.
   • CImplement UEBA to establish baseline behavior and alert on anomalies, combined with DLP to block unauthorized data transfers.
   • DIncrease the frequency of security awareness training and require all employees to sign a data handling policy.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A manufacturing company has noticed that attackers are increasingly using legitimate cloud collaboration tools (e.g., Microsoft 365, Google Workspace) to host phishing pages and deliver malware. The company's web filter blocks known malicious domains but does not inspect traffic to popular cloud services. Which enhancement would most effectively address this trend?

   • AEnable TLS inspection on the web proxy for cloud service domains and apply category-based policies to block untrusted file sharing.
   • BDeploy a data loss prevention (DLP) solution focused on outbound email and USB device control.
   • CIncrease the frequency of threat intelligence feed updates from daily to hourly.
   • DAdd all known cloud service domains to an allowlist so that employees can access them without interruption.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A small e-commerce company has a single IT administrator who manages both network infrastructure and security. The company recently suffered a ransomware attack that encrypted its file server. The administrator restored from backups, but the attack succeeded because a phishing email bypassed the email filter. The company cannot afford a dedicated security team. Which measure would be most effective in reducing the likelihood of a similar attack?

   • AConfigure the firewall to block all inbound traffic from foreign IP addresses.
   • BIncrease the frequency of full backups to every six hours and store them on a separate NAS device.
   • CPurchase a second, different email filtering product and route all inbound email through both filters in series.
   • DImplement application allowlisting on endpoints to prevent unauthorized executables from running.
   Reveal Solution Discussion Select an answer first