Emerging Threats, Threat Actors, and Attack Vectors TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is profiling a threat actor that has been observed using advanced techniques, including zero-day exploits and custom malware, to target a specific organization over a long period. The actor's goal appears to be intellectual property theft. Which threat actor category is most likely?

   • AHacktivist collective
   • BCybercriminal syndicate
   • CNation-state APT group
   • DScript kiddie
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which attack vector involves tricking a user into opening a malicious attachment or clicking a link that leads to malware installation?

   • APhishing
   • BZero-day exploit
   • CSQL injection
   • DMan-in-the-middle (MITM)
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A financial services firm is reviewing its security posture after a series of attacks where employees received SMS messages claiming their accounts were locked, with a link to a fake banking portal. The firm wants to implement controls to reduce the success of this specific attack vector. Which control is most directly effective?

   • ADisable all SMS-based authentication and switch to hardware tokens.
   • BProvide user awareness training on smishing and deploy an SMS filtering solution.
   • CImplement SIM-swap detection and require additional verification for password resets.
   • DDeploy a mobile device management (MDM) solution that restricts the installation of apps from unknown sources.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is profiling a threat actor that has been observed using a mix of low-sophistication tools and occasional advanced techniques. The actor's targets are primarily small and medium-sized businesses (SMBs) in various industries. The actor appears to be financially motivated but also has been seen selling stolen data on underground forums. Which threat actor category best fits this profile?

   • ACybercriminal group with a business model of data theft and resale
   • BInsider threat
   • CHacktivist collective
   • DNation-state APT group
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A mid-sized e-commerce company has been hit by a new ransomware strain that encrypts files and also steals data before encryption. The attackers demand payment in cryptocurrency and threaten to leak the stolen data if not paid. The company has backups, but the backups are also partially encrypted because the backup account had excessive privileges. The company's leadership wants to restore operations quickly while minimizing data loss. Which approach is the best balance of speed and risk?

   • AAttempt to decrypt the files using free decryption tools available online.
   • BPay the ransom to obtain the decryption key and restore data quickly.
   • CRestore from the last known-good backup that predates the compromise, after verifying the backup system is isolated and the attacker's access is removed.
   • DRestore from the most recent backup, even if it might contain the ransomware, to minimize data loss.
   Reveal Solution Discussion Select an answer first