Integrating Threat Intelligence with Risk Management TIE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which risk treatment option involves taking action to reduce the likelihood or impact of a risk, often guided by threat intelligence?

   • AMitigate
   • BAvoid
   • CAccept
   • DTransfer
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A small business has limited budget and discovers from threat intelligence that a specific ransomware family is targeting their industry. The business has no sensitive data but relies heavily on availability of its systems. Which risk treatment option is most appropriate?

   • AAvoid the risk by disconnecting all systems from the internet.
   • BMitigate by implementing robust backups and recovery procedures to reduce the impact of a ransomware attack.
   • CTransfer the risk by purchasing cyber insurance that covers business interruption.
   • DAccept the risk because the business has no sensitive data.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An organization's risk score for a vulnerability is initially low. After receiving threat intelligence that a known exploit is actively being used in the wild, how should the risk score be adjusted?

   • AKeep the score unchanged because the vulnerability has not changed
   • BIncrease the score because the likelihood of exploitation has increased
   • CDecrease the score because the threat is now known
   • DSet the score to zero because the threat is already public
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial services firm is choosing a risk assessment methodology. They have detailed historical data on the frequency and financial impact of cyber incidents, and they need to produce a cost-benefit analysis for proposed security investments. Which methodology is most appropriate?

   • AQuantitative risk assessment using ALE and SLE calculations.
   • BHybrid risk assessment that only uses qualitative ratings for all risks.
   • CQualitative risk assessment using a high/medium/low rating scale.
   • DThreat intelligence-driven risk assessment that ignores historical data.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A university's IT department is designing a continuous monitoring process for its research network. They want to use threat intelligence to update risk assessments for research data. The network contains sensitive research data that is subject to data protection regulations. Which design element is most important for the continuous monitoring process?

   • AAutomated ingestion of threat intelligence feeds and correlation with the asset inventory.
   • BUpdating risk assessments only when a security incident occurs.
   • CManual review of threat intelligence reports on a monthly basis.
   • DFocusing only on external threat intelligence and ignoring internal telemetry.
   Reveal Solution Discussion Select an answer first