An organization receives threat intelligence about a new ransomware strain that encrypts files and demands payment. The intelligence includes the ransomware's behavior: it spreads via SMB and uses a specific C2 domain. The organization has a mix of Windows and Linux servers. Which threat should be prioritized for immediate action?

All threats equally, because any threat can cause damage

The ransomware, because it can impact critical Windows servers

The C2 domain, because it is a network indicator

The Linux servers, because they are less common

A company's security team reads a threat report that describes a new exploit kit targeting a vulnerability in a browser plugin. The report includes the exploit code. The company uses the affected plugin in a legacy application that is critical to operations. The vendor has not released a patch. What is the most effective mitigation?

Disable the plugin in the browser

Increase browser security settings

Wait for the vendor to release a patch

Block the exploit code at the web gateway

A security team has identified two threats: one that could cause a minor data breach with a high chance of occurrence, and another that could cause a catastrophic outage but is very unlikely. What is the primary purpose of prioritizing threats in this scenario?

To eliminate all threats completely

To increase the likelihood of all threats

To allocate limited security resources effectively

To satisfy regulatory compliance only

A company's security team is assessing the impact of a new vulnerability in a widely used content management system (CMS). The company uses the CMS for its public website, which handles customer data. The vulnerability allows remote code execution. The team must decide whether to take the website offline to patch it. What is the most important factor in this decision?

The availability of the website

The cost of the patching process

The reputation of the CMS vendor

The potential impact on customer data confidentiality

Which of the following is an example of an industry publication that provides threat research and analysis?

A personal blog with no editorial review

SANS Internet Storm Center (ISC) diaries

A company's internal incident response runbook

F5Certified Solution Expert, Security

Domain 1Objective 1

1.01 Analyze External Threat Research to Determine the Potential Impact to an Organization 401 Practice Questions (Page 2)

Part of the THREAT ANALYSIS domain, which makes up ~11% of our current practice bank. F5 does not publish an official question count, but from its 105-minute exam (~40–70 total, ~4–8 in this domain), expect 2–4 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

4concepts

Questions 6–10

6application · medium
An organization receives threat intelligence about a new ransomware strain that encrypts files and demands payment. The intelligence includes the ransomware's behavior: it spreads via SMB and uses a specific C2 domain. The organization has a mix of Windows and Linux servers. Which threat should be prioritized for immediate action?
Select an answer first
7application · medium
A company's security team reads a threat report that describes a new exploit kit targeting a vulnerability in a browser plugin. The report includes the exploit code. The company uses the affected plugin in a legacy application that is critical to operations. The vendor has not released a patch. What is the most effective mitigation?
Select an answer first
8foundation · easy
A security team has identified two threats: one that could cause a minor data breach with a high chance of occurrence, and another that could cause a catastrophic outage but is very unlikely. What is the primary purpose of prioritizing threats in this scenario?
Select an answer first
9expert · hard
A company's security team is assessing the impact of a new vulnerability in a widely used content management system (CMS). The company uses the CMS for its public website, which handles customer data. The vulnerability allows remote code execution. The team must decide whether to take the website offline to patch it. What is the most important factor in this decision?
Select an answer first
10foundation · easy
Which of the following is an example of an industry publication that provides threat research and analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “401” is a trademark of its owner, used for identification only.

1.01 Analyze External Threat Research to Determine the Potential Impact to an Organization 401 Practice Questions (Page 2)

Questions 6–10

A security team has identified two threats: one that could cause a minor data breach with a high chance of occurrence, and another that could cause a catastrophic outage but is very unlikely. What is the primary purpose of prioritizing threats in this scenario?

Which of the following is an example of an industry publication that provides threat research and analysis?

Keep studying — THREAT ANALYSIS