1.01 Analyze External Threat Research to Determine the Potential Impact to an Organization 401 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A threat intelligence report reveals a vulnerability in a widely used network firewall that could allow remote code execution. What is the most important factor to consider when assessing the impact of this threat on an organization?

   • AThe color of the firewall chassis
   • BThe organization's marketing budget
   • CThe number of employees in the organization
   • DWhether the organization uses the affected firewall model
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team reviews two threat reports. Report A describes a vulnerability in a widely used web server that is actively exploited in the wild. Report B describes a vulnerability in a niche legacy application that is not exposed to the internet and has no known exploits. The team has limited resources. Which threat should be prioritized?

   • AReport B, because legacy applications are harder to patch
   • BReport A, but only if the web server is internet-facing
   • CBoth equally, because all vulnerabilities should be treated the same
   • DReport A, because it has a higher likelihood of exploitation and potential impact
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A healthcare organization reads a government advisory about a ransomware group that has been targeting the sector. The advisory lists the group's preferred initial access vector as phishing emails with malicious LNK files. The organization's security team wants to reduce the risk of a successful attack. Which control is most directly aligned with the threat intelligence?

   • ABlock LNK file attachments in email
   • BEnable macro blocking in Microsoft Office
   • CDeploy a web application firewall
   • DIncrease password complexity requirements
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization's security team is analyzing a threat report about a new malware strain. The report includes a detailed analysis of the malware's behavior, including its persistence mechanism and C2 communication. The team wants to create a detection rule for their SIEM. Which information from the report is most useful for creating a host-based detection rule?

   • AThe malware's file size
   • BThe C2 domains
   • CThe report's threat actor profile
   • DThe malware's persistence mechanism
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A threat intelligence report describes a phishing campaign that uses a specific subject line and a malicious attachment. The report includes the attachment's hash and the sender's email address. An organization wants to block this campaign at the email gateway. Which intelligence is most directly useful?

   • AThe sender's email address
   • BThe attachment hash
   • CThe subject line
   • DThe report's executive summary
   Reveal Solution Discussion Select an answer first