Cyber Threat Trends and Challenges TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A non-profit organization has a small IT team and relies heavily on volunteers. It has experienced several successful phishing attacks that led to credential compromise. The organization wants to improve its security posture with minimal cost and administrative overhead. Which measure is most appropriate?

   • AConduct weekly penetration tests on the organization's systems.
   • BImplement a strict password policy that requires complex passwords and frequent changes.
   • CPurchase an enterprise-grade security information and event management (SIEM) solution.
   • DEnable multi-factor authentication (MFA) on all email and cloud accounts.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A software development company has noticed that attackers are poisoning open-source software packages used in its build pipeline. The attackers publish malicious versions of popular libraries with similar names or slightly altered code. The company's developers download dependencies directly from public repositories. Which control would best mitigate this supply chain threat?

   • AUse a software composition analysis (SCA) tool that scans for known vulnerabilities in dependencies.
   • BImplement a private package repository that proxies public registries and enforces allowlists of approved package versions.
   • CRequire developers to manually review the source code of every dependency before including it in a project.
   • DDisable all third-party dependencies and require developers to write all code in-house.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A multinational corporation has observed a surge in ransomware attacks that use double extortion: data exfiltration followed by encryption. The company's security team has implemented robust backups and can restore systems, but the attackers threaten to leak sensitive customer data if the ransom is not paid. The company's legal counsel advises that paying the ransom may violate sanctions regulations. The company has cyber insurance that covers ransom payments but not regulatory fines. Which strategy best addresses the threat while balancing legal, financial, and operational concerns?

   • AImplement a threat hunting program to identify and remove attackers before they can exfiltrate data.
   • BImmediately disconnect all internet-facing systems to prevent any data exfiltration.
   • CPurchase additional cyber insurance that covers regulatory fines and pay the ransom if a breach occurs.
   • DFocus on preventing data exfiltration by implementing data loss prevention (DLP) and encryption, and prepare a communication plan for potential data breaches.
   Reveal Solution Discussion Select an answer first
5. 24foundation · medium

   Which of the following is a common challenge organizations face in defending against evolving cyber threats?

   • AA shortage of skilled cybersecurity professionals
   • BToo many qualified candidates for security roles
   • CExcess budget allocated to threat intelligence
   • DA lack of any known attack techniques
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A marketing agency has seen a rise in account takeover attacks on its social media accounts. The attackers use credential stuffing and phishing to gain access. The agency manages multiple client accounts and has a small team. Which control would be most effective in preventing account takeovers?

   • AEnforce multi-factor authentication (MFA) on all social media accounts and use a password manager to generate unique passwords.
   • BChange all social media passwords every 30 days.
   • CMonitor social media accounts for suspicious activity and respond to alerts during business hours.
   • DLimit the number of people who have access to social media accounts to one designated employee.
   Reveal Solution Discussion Select an answer first