Threat Prioritization, Actor Profiling, and Attribution TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A hospital's security operations center receives threat intelligence from multiple sources. One feed reports a new ransomware strain targeting Windows servers, another reports a phishing campaign against a specific email gateway, and a third contains generic malware signatures. The hospital's most critical asset is the electronic health record (EHR) system, which runs on Windows servers. Which feed should the analyst escalate first?

   • AThe ransomware strain targeting Windows servers, because it directly affects the EHR system
   • BAll feeds equally, because every threat should be investigated immediately
   • CThe generic malware signatures, because they cover the broadest range of threats
   • DThe phishing campaign, because email is a common initial vector
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A manufacturing company is conducting a threat prioritization exercise. The company has three key assets: a public web server, an internal HR database, and a proprietary product design repository. The web server is externally accessible but contains only marketing content; the HR database contains employee PII; the design repository is the company's main competitive advantage. Which asset should be considered the most critical for prioritization?

   • AThe public web server, because it is externally accessible
   • BThe proprietary product design repository, because it provides the company's competitive advantage
   • CThe internal HR database, because it contains personal data
   • DAll assets are equally critical because they are all part of the company's infrastructure
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a risk matrix used for threat prioritization, which two dimensions are typically plotted to determine the overall risk rating?

   • ASeverity and complexity
   • BCost and speed
   • CLikelihood and impact
   • DThreat and vulnerability
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of attribution in threat intelligence?

   • ATo prevent future attacks by patching vulnerabilities
   • BTo identify the responsible threat actor or group behind an incident
   • CTo quantify the financial loss of an incident
   • DTo restore affected systems to normal operation
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why is it important to communicate uncertainty in attribution conclusions?

   • ABecause uncertainty is a legal requirement
   • BBecause attribution is often based on incomplete or ambiguous evidence
   • CBecause uncertainty makes reports more complex
   • DBecause stakeholders always require absolute certainty
   Reveal Solution Discussion Select an answer first