Threat Prioritization, Actor Profiling, and Attribution TIE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A cybersecurity team is using a risk matrix to prioritize threats for a hospital. The hospital has a patient monitoring system (IoT devices), an EHR system, and a public website. A threat report indicates a new ransomware that targets IoT devices, but the exploit requires being on the same network. Another report describes a phishing campaign that targets hospital staff and can lead to credential theft. Which threat should be prioritized?

   • ABoth equally, because they both affect patient care
   • BThe public website, because it is externally accessible
   • CThe IoT ransomware, because it targets a critical patient safety system
   • DThe phishing campaign, because it has a higher likelihood and can lead to broader compromise
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of grouping related activities into actor campaigns?

   • ATo identify patterns and link separate incidents to a common threat actor
   • BTo assign blame to a specific country
   • CTo increase the number of indicators in a report
   • DTo create a timeline of all network traffic
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In actor profiling, what does 'capability' refer to?

   • AThe level of skill and resources an actor can apply to an attack
   • BThe actor's geographic location
   • CThe actor's political affiliation
   • DThe actor's preferred time of day for attacks
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A large e-commerce company uses a risk matrix to prioritize threats. The company's customer database is critical, and its public website is important but not critical. A vulnerability is discovered in the website's content management system with a CVSS score of 9.8, and a separate vulnerability in the customer database with a CVSS score of 6.5. The company has limited patching resources. Which vulnerability should be patched first?

   • AThe website vulnerability, because the CVSS score is significantly higher.
   • BPatch the website first because it is internet-facing and more likely to be exploited.
   • CPatch both simultaneously, because both are important.
   • DThe customer database vulnerability, because the asset is critical even though the CVSS score is lower.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A regional bank's threat intelligence team receives a daily feed containing hundreds of raw indicators. The bank's core banking system is a legacy mainframe that cannot be patched, while the public-facing mobile app is fully patched and containerized. The team must prioritize which indicators to investigate first. Using a risk-matrix approach, which factor should carry the most weight when ranking the indicators?

   • AThe total volume of indicators in the feed that day
   • BThe criticality of the asset each indicator targets and the likelihood of exploitation
   • CThe age of the oldest indicator in the feed
   • DThe number of indicators that match the mobile app's IP reputation list
   Reveal Solution Discussion Select an answer first