Threat Prioritization, Actor Profiling, and Attribution TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An incident response team discovers that a breach used a phishing email with a malicious attachment that matches a known APT's toolset. However, the phishing email was sent from a compromised legitimate account, and the malware's C2 infrastructure is shared with another unrelated group. What is the most appropriate attribution statement?

   • AAttribution is impossible because the email account was compromised
   • BThe other group is responsible because they share the C2 infrastructure
   • CThe APT is responsible because the toolset matches perfectly
   • DThe APT is likely responsible, but the shared infrastructure and compromised account reduce confidence
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which approach best reflects the purpose of an asset criticality assessment in threat intelligence?

   • ATo assign a business value to assets so that threats targeting high-value assets are prioritized
   • BTo identify all vulnerabilities present in an asset
   • CTo determine the cost of purchasing replacement hardware
   • DTo map network traffic flows between assets
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst is preparing an attribution report for a cyber incident. The evidence includes a unique malware hash, a known command-and-control domain, and a similar phishing lure used by a specific group. However, the malware was also seen in a public sandbox analysis that could have been uploaded by anyone. What is the most appropriate way to present the attribution confidence?

   • APresent the evidence and state that the group is a likely suspect, but with medium confidence due to the possibility of indicator manipulation.
   • BRefuse to include any attribution in the report because the evidence is not 100% conclusive.
   • CState that the group is responsible with high confidence because multiple technical indicators match.
   • DAttribute the attack to a different group because the public sandbox upload suggests the malware is not exclusive.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A threat intelligence team has been tracking a financially motivated actor for two years. Over the past six months, the actor has shifted from using commodity ransomware to a custom loader and has started targeting a new industry. The team must update its tracking. What is the most appropriate action?

   • AUpdate the existing actor profile to reflect the new tools and targets, and note the evolution in a campaign timeline.
   • BMerge the actor with a different known group that uses a similar custom loader.
   • CCreate a new actor profile because the change in tactics and targets indicates a completely different group.
   • DStop tracking the actor because the changes make historical intelligence irrelevant.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A utility company is assessing threats to its industrial control systems (ICS). A hacktivist group has threatened to disrupt operations, while a financially motivated cybercrime group has been observed scanning for internet-exposed ICS devices. The company must prioritize its defenses. Which factor is most important to consider?

   • AThe company should focus on the cybercrime group because they have more resources and capability.
   • BBoth groups should be treated equally because any attack on ICS is unacceptable.
   • CThe hacktivist group's motivation to cause disruption directly aligns with the potential impact on ICS availability.
   • DThe cybercrime group's scanning activity indicates a higher likelihood of attack, so they should be prioritized.
   Reveal Solution Discussion Select an answer first