Threat Prioritization, Actor Profiling, and Attribution TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security operations center (SOC) receives a large number of threat intelligence feeds. The SOC is responsible for protecting a hospital's patient records system, which is critical, and a public-facing appointment portal, which is less critical. The SOC has limited analysts. Which triage strategy is most effective?

   • APrioritize indicators that target the patient records system and have a high severity score, then review lower-priority items as time permits.
   • BFocus only on indicators with a high severity score, regardless of the asset they affect.
   • CAutomatically block all indicators from the feeds to reduce the analyst workload.
   • DAnalyze all indicators equally to avoid missing any potential threat.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which term best describes the degree of certainty that an attribution conclusion is correct?

   • AIndicator of compromise
   • BConfidence level
   • CAttack vector
   • DKill chain phase
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A financial institution uses a risk matrix to prioritize threats. The institution's transaction processing system is critical, and its employee email system is important but not critical. A vulnerability is discovered in the email system with a CVSS score of 9.0, and a separate vulnerability in the transaction system with a CVSS score of 7.5. The institution has limited patching resources. Which vulnerability should be patched first?

   • APatch the email system first because it is more likely to be exploited due to its high severity.
   • BPatch both simultaneously, because both are important.
   • CThe email system vulnerability, because the CVSS score is significantly higher.
   • DThe transaction system vulnerability, because the asset is critical even though the CVSS score is lower.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which element is most important to include in an attribution report?

   • AThe personal opinion of the analyst
   • BThe estimated cost of the attack
   • CThe attacker's likely name and address
   • DThe evidence supporting the attribution conclusion
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which action is an example of threat intelligence triage?

   • AConducting a forensic analysis of a compromised host
   • BPublishing a threat report to the public
   • CDeveloping a new detection rule for a SIEM
   • DAssigning a priority score to a newly received indicator based on its relevance to the organization
   Reveal Solution Discussion Select an answer first