Integrating Threat Intelligence with Risk Management TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A government agency has a risk management process that is updated annually. After a series of cyberattacks on other agencies, threat intelligence indicates that similar attacks are likely. The agency wants to improve its responsiveness. Which action is most effective?

   • ARely on the security team's intuition to adjust risk scores when they feel it is necessary.
   • BWait for the next annual assessment to incorporate the new intelligence.
   • CImplement a continuous monitoring process that feeds threat intelligence into the risk register on a monthly basis.
   • DIncrease the risk scores of all assets by one level and keep them there permanently.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A retail company has a risk management process that updates risk scores annually. After a major data breach in the industry, threat intelligence indicates that similar attacks are increasing. The CISO wants to implement a more responsive process. Which change is most effective?

   • AIncrease the risk scores of all assets by one level and keep them there permanently.
   • BWait for the next annual assessment to incorporate the new intelligence.
   • CRely on the security team's intuition to adjust risk scores when they feel it is necessary.
   • DEstablish a quarterly review of risk scores that incorporates the latest threat intelligence.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A multinational corporation uses a threat-informed risk scoring model where risk = likelihood × impact. A threat intelligence report indicates that a specific Advanced Persistent Threat (APT) group is targeting the company's intellectual property. The APT is known for using spear-phishing and zero-day exploits. The company has a strong security awareness program but cannot patch all systems immediately. Which adjustment to the risk score is most appropriate?

   • ADecrease the risk score because the APT is known and defenders can prepare.
   • BKeep the risk score unchanged because the company has a strong security awareness program.
   • CIncrease likelihood because the APT is active and uses sophisticated methods, and increase impact because IP loss is severe.
   • DIncrease likelihood only, because the APT is active, but keep impact unchanged because the company has strong security awareness.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A logistics company has a critical application that is essential for daily operations. Threat intelligence indicates a specific malware strain is targeting the application's underlying operating system, and the vendor has released a patch. The company's change management process requires a two-week testing period before deploying patches. What is the most appropriate risk treatment option?

   • AAccept the risk for two weeks while the patch is tested, but implement temporary compensating controls.
   • BTransfer the risk to the patch vendor by relying on their support.
   • CMitigate the risk by deploying the patch immediately, even if it bypasses the change management process.
   • DAvoid the risk by shutting down the application until the patch is deployed.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is deciding between a quantitative and a qualitative risk assessment methodology. They have some historical data but it is incomplete and not fully reliable. Threat intelligence provides current information about active threats. Which methodology is most appropriate?

   • AQualitative risk assessment that ignores the historical data entirely.
   • BQuantitative risk assessment using only the historical data, even if incomplete.
   • CHybrid risk assessment that uses quantitative data where available and qualitative judgment for gaps.
   • DThreat intelligence-driven assessment that replaces both quantitative and qualitative methods.
   Reveal Solution Discussion Select an answer first