Threat Prioritization, Actor Profiling, and Attribution TIE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A regional bank's threat intelligence team receives a daily feed of 500+ indicators and alerts. The bank's core banking system is considered critical, while the marketing website is low-impact. The team must triage the feed to focus on the most relevant threats. Which approach best aligns with the bank's priorities?

   • APrioritize alerts that reference the core banking system's software versions and apply a CVSS-based severity filter before manual review.
   • BFocus exclusively on alerts with a high CVSS score, ignoring the asset context because severity alone determines risk.
   • CAutomatically block all IP addresses from the feed to reduce the number of alerts requiring analysis.
   • DReview all alerts in chronological order to ensure no potential threat is missed, regardless of asset or severity.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A threat intelligence team is tracking a group that has been active for several years. Recently, the group's malware has become more sophisticated, and they have started targeting a new industry. The team has also observed a new group using similar TTPs but different malware. How should the team handle the relationship between the two groups?

   • AStop tracking the original group because they have changed their targeting
   • BMerge the two groups because they share similar TTPs
   • CAssume the new group is a rebranding of the original group
   • DKeep the groups separate but note the TTP similarities and monitor for further convergence
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A national infrastructure provider is assessing threats from two actors: a hacktivist group known for DDoS attacks and a state-sponsored group known for stealthy espionage. The provider's primary concern is maintaining service availability. Which actor should be prioritized?

   • AThe state-sponsored group, because they have more resources and sophistication.
   • BThe state-sponsored group, because they are more likely to cause long-term damage.
   • CBoth equally, because any threat to national infrastructure is critical.
   • DThe hacktivist group, because their known DDoS capability directly threatens service availability.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An analyst is attributing a cyber incident to a known APT group. The evidence includes a malware sample that is nearly identical to the group's previous tools, but the C2 infrastructure is different and the malware contains a string that suggests a different country. The analyst must decide how to present the attribution to a government client. What is the most defensible approach?

   • AAttribute to the APT group with high confidence because the malware is nearly identical
   • BRefrain from making any attribution because the conflicting indicators make it impossible
   • CPresent the malware similarity as strong evidence, but note the conflicting indicators and assign a moderate confidence level
   • DAttribute to the country suggested by the language string because it is a new clue
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Why is it important to track changes in a threat actor's behavior over time?

   • ATo predict the exact date of the next attack
   • BTo determine the actor's physical location
   • CTo update detection and response strategies as the actor evolves
   • DTo calculate the actor's financial budget
   Reveal Solution Discussion Select an answer first