Integrating Threat Intelligence with Risk Management TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A small online retailer has a legacy customer database that is no longer used by any application but still contains sensitive customer data. Threat intelligence indicates that this type of data is a prime target for ransomware groups. The retailer is considering risk treatment options. Which option best aligns with the threat intelligence insight?

   • AAvoid the risk by securely decommissioning and deleting the legacy database.
   • BAccept the risk because the database is not actively used and the retailer has limited resources.
   • CMitigate the risk by encrypting the database and implementing access controls.
   • DTransfer the risk by purchasing cyber insurance that covers ransomware incidents.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A regional bank is updating its annual risk assessment. The CISO wants to incorporate current threat intelligence to better estimate the likelihood of a ransomware attack. The bank has historical loss data for past incidents, but the threat landscape has shifted significantly. Which approach best integrates threat intelligence into the risk assessment?

   • AUse a qualitative methodology, rating risks as high, medium, or low based solely on the severity of past incidents.
   • BPerform a purely quantitative analysis using historical loss data without adjusting for current threat intelligence.
   • CUse a quantitative methodology, assigning monetary values to assets and using threat intelligence to adjust the frequency of loss events.
   • DAdopt a hybrid methodology that uses qualitative ratings for impact and threat intelligence only for new, emerging threats.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An e-commerce company uses a threat-informed risk scoring model where each risk is scored as likelihood × impact. A threat intelligence report reveals that a new exploit kit is targeting the company's content management system (CMS) version. The exploit kit is easy to use and has a high success rate. How should the company adjust the risk score for the CMS vulnerability?

   • AIncrease only the impact score because the exploit kit is easy to use.
   • BIncrease both the likelihood and impact scores because the threat is active and the CMS is business-critical.
   • CDecrease the likelihood score because the exploit kit is widely known and defenders are aware of it.
   • DKeep the risk score unchanged because the company has a web application firewall (WAF) in place.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When an organization decides to purchase cyber insurance to cover losses from a specific threat, which risk treatment option are they applying?

   • AMitigate
   • BAvoid
   • CTransfer
   • DAccept
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How does a qualitative risk assessment methodology typically incorporate threat intelligence?

   • ABy ignoring threat intelligence and relying solely on historical data
   • BBy using only automated tools to compute risk scores
   • CBy assigning subjective ratings such as high, medium, or low to threat likelihood and impact
   • DBy calculating annualized loss expectancy using monetary values
   Reveal Solution Discussion Select an answer first