Threat Prioritization, Actor Profiling, and Attribution TIE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst must write an attribution report for a board of directors. The report will be used to decide whether to invest in additional security controls. The evidence is strong but not conclusive. Which approach best supports the board's decision-making?

   • APresent the evidence, the confidence level, and the potential impact of the threat, and recommend security investments based on the risk
   • BFocus only on the technical details and let the board draw their own conclusions
   • CRecommend the investment regardless of the attribution because any threat is worth mitigating
   • DProvide a definitive attribution to justify the security investment
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is investigating a series of attacks on a media organization. The attacks include website defacement, email phishing, and a sophisticated intrusion that exfiltrated unpublished articles. The defacement used a known hacktivist tool, the phishing emails were sent from a compromised account, and the intrusion used a zero-day exploit. How should the team profile the actors?

   • ATreat all attacks as the work of a single advanced actor because they target the same organization
   • BAttribute all attacks to the hacktivist group because the defacement tool is the most identifiable
   • CProfile the defacement as hacktivist, the phishing as a separate criminal operation, and the intrusion as a sophisticated espionage actor
   • DConclude that the phishing and intrusion are the same actor because they both used compromised accounts
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A threat intelligence analyst must write a report on a suspected state-sponsored intrusion for the company's board of directors. The evidence is strong but not conclusive. What is the most appropriate way to present the findings?

   • ADelay the report until attribution is 100% certain, even if it takes months.
   • BProvide only the technical indicators without any conclusion, letting the board interpret them.
   • CPresent the evidence and clearly state the confidence level, including alternative explanations.
   • DState the attribution as fact to avoid confusing the board with uncertainty.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An incident response team observes a series of intrusions at a defense contractor. The attacks use a custom backdoor that shares code with a known APT group's tool, but the command-and-control infrastructure is registered through a service commonly used by a different, unrelated group. The team must decide how to attribute the incident. What is the most appropriate conclusion?

   • AAttribute the attack to the APT group whose tool code is shared, because code reuse is the strongest indicator of identity.
   • BState that attribution is impossible because the indicators conflict, and provide no assessment.
   • CConclude that the attack is likely from the APT group, but with moderate confidence, and note the conflicting infrastructure evidence.
   • DAttribute the attack to the unrelated group because the infrastructure is more recent and easier to trace.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst has completed an attribution analysis and must write a report for a non-technical executive audience. The evidence includes overlapping infrastructure and similar malware, but the analyst is not fully certain. What is the most appropriate way to structure the report?

   • AState the attribution as definitive to avoid confusing the executives
   • BProvide a clear conclusion with a confidence level, a summary of key evidence, and an explanation of uncertainties
   • COmit the attribution conclusion and only list the observed indicators
   • DLead with the technical indicators and let the executives interpret them
   Reveal Solution Discussion Select an answer first