Integrating Threat Intelligence with Risk Management TIE Practice Questions (Page 9)

Questions 41–43

1. 41expert · hard

   A software company has a critical vulnerability in a product that is widely used by its customers. Threat intelligence shows that exploit code is publicly available. The company has limited resources and must decide how to treat the risk. Which option is the most balanced approach?

   • AMitigate by developing and releasing a patch as soon as possible, while also providing temporary workarounds.
   • BAccept the risk because the vulnerability is in the product, not the company's internal systems.
   • CAvoid the risk by discontinuing the product immediately.
   • DTransfer the risk by requiring customers to sign liability waivers.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A regional bank uses a qualitative risk assessment with a 5x5 likelihood-impact matrix. After a threat intelligence report indicates a surge in phishing campaigns targeting banks in the same jurisdiction, the risk owner wants to reflect this in the risk register. The bank's current phishing risk is rated 'Medium' (likelihood 3, impact 3). Which action best applies the threat intelligence to the risk assessment?

   • AIncrease the likelihood score to 4, keeping impact at 3, so the risk becomes 'High'.
   • BIncrease the impact score to 4, keeping likelihood at 3, because phishing is a serious threat.
   • CMove the risk to 'Accept' because the bank has cyber insurance that covers phishing losses.
   • DKeep the risk at 'Medium' because the impact has not changed and the bank already has email filtering in place.
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   A large enterprise has a continuous monitoring process that updates risk scores based on threat intelligence. The process currently uses a manual review of threat feeds every 48 hours. The security team wants to improve the process to respond faster to emerging threats. Which improvement would be most effective?

   • AReplace the risk scoring model with a simpler one that is easier to update manually.
   • BIncrease the frequency of manual reviews to every 24 hours.
   • CFocus on a single high-quality threat intelligence feed to reduce noise.
   • DAutomate the ingestion and correlation of threat intelligence with the asset inventory to update risk scores in near real-time.
   Reveal Solution Discussion Select an answer first