Integrating Threat Intelligence with Risk Management TIE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company has a third-party vendor that provides critical services. Threat intelligence reveals that the vendor has a significant vulnerability that could be exploited. The company has a strong security team but limited budget. Which risk treatment option is most appropriate?

   • AAccept the risk because the vendor is responsible for its own security.
   • BMitigate by working with the vendor to implement compensating controls and monitoring.
   • CAvoid the risk by terminating the vendor relationship immediately.
   • DTransfer the risk by requiring the vendor to sign a contract that holds them liable.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security operations center (SOC) is designing a continuous monitoring process that uses threat intelligence to update risk assessments. The SOC wants to ensure that new indicators of compromise (IOCs) are quickly reflected in the risk scores of affected assets. Which approach best achieves this?

   • AManually review IOCs on a weekly basis and update the risk register during the weekly meeting.
   • BOnly update risk scores after a confirmed incident occurs.
   • CAutomatically correlate incoming IOCs with the asset inventory and adjust risk scores in the risk register.
   • DSend IOCs to the IT team to patch affected systems without updating the risk register.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A hospital discovers that a medical device has a known vulnerability that could allow remote control. Threat intelligence shows that similar devices are being targeted by ransomware groups. The hospital cannot replace the device immediately. Which risk treatment option is most appropriate in the short term?

   • ATransfer the risk by purchasing cyber insurance.
   • BAccept the risk because the device is essential for patient care.
   • CAvoid the risk by disconnecting the device from the network entirely.
   • DMitigate by isolating the device on a separate network segment and monitoring for anomalies.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A healthcare provider discovers from threat intelligence that a specific strain of ransomware is actively targeting hospitals and has a high success rate against their EHR vendor's software. The provider's risk assessment shows that a successful attack would severely disrupt patient care. Which risk treatment option is most appropriate given this intelligence?

   • AMitigate by applying vendor patches and implementing additional network segmentation for the EHR system.
   • BAvoid the risk by discontinuing use of the EHR vendor's software immediately.
   • CAccept the risk because the threat is external and the provider has insurance coverage.
   • DTransfer the risk by purchasing cyber insurance and not changing any security controls.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial services firm has implemented a threat intelligence platform that generates alerts about emerging malware campaigns. The CISO wants to ensure that these alerts are used to continuously update the firm's risk assessments. Which process best achieves this objective?

   • ASend threat intelligence alerts to the security team for manual review and ad-hoc action.
   • BStore threat intelligence alerts in a separate log for auditors to review at year-end.
   • CAutomatically feed threat intelligence alerts into the risk register and trigger a reassessment of affected assets.
   • DUse threat intelligence only during the annual risk assessment cycle.
   Reveal Solution Discussion Select an answer first