A security operations center (SOC) is using the Cyber Kill Chain to analyze a recent intrusion. They have identified the following events: (1) a spear-phishing email with a malicious attachment, (2) the attachment dropped a dropper that downloaded a remote access trojan (RAT), (3) the RAT established command-and-control (C2) communication, (4) the attacker used the RAT to move laterally to a database server, and (5) the attacker exfiltrated customer data. The SOC wants to implement controls to break the chain at multiple stages. Which combination of controls would be most effective?

Only endpoint antivirus and user awareness training

Only network monitoring and log analysis

Email filtering, endpoint detection and response (EDR), network segmentation, and data loss prevention (DLP)

Only a next-generation firewall with intrusion prevention

When profiling an adversary, what does 'intent' refer to?

The adversary's available funding and personnel

The adversary's technical skill level

The adversary's preferred attack tools

The adversary's motivation and objectives

A company has just discovered that an employee's laptop, which was used to access the corporate network via VPN, was infected with malware. The malware communicated with an external server. The security team wants to determine the potential exposure of the corporate network. What should they do first?

Disconnect the laptop from the network and reimage it

Block the external server's IP address at the firewall

Review the VPN logs to identify the internal systems the employee accessed

GIAC Information Security Fundamentals

Domain 3Objective 1

Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 1)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 1–5

1application · medium
A development team is using STRIDE to threat-model a new authentication service. They have identified that an attacker could intercept and modify the authentication token in transit. Which STRIDE category does this threat fall under?
Select an answer first
2expert · hard
A security operations center (SOC) is using the Cyber Kill Chain to analyze a recent intrusion. They have identified the following events: (1) a spear-phishing email with a malicious attachment, (2) the attachment dropped a dropper that downloaded a remote access trojan (RAT), (3) the RAT established command-and-control (C2) communication, (4) the attacker used the RAT to move laterally to a database server, and (5) the attacker exfiltrated customer data. The SOC wants to implement controls to break the chain at multiple stages. Which combination of controls would be most effective?
Select an answer first
3foundation · easy
When profiling an adversary, what does 'intent' refer to?
Select an answer first
4application · medium
A company has just discovered that an employee's laptop, which was used to access the corporate network via VPN, was infected with malware. The malware communicated with an external server. The security team wants to determine the potential exposure of the corporate network. What should they do first?
Select an answer first
5foundation · easy
A threat actor is primarily motivated by financial gain and uses sophisticated malware to steal credit card data. Which category best describes this actor?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 1)

Questions 1–5

A development team is using STRIDE to threat-model a new authentication service. They have identified that an attacker could intercept and modify the authentication token in transit. Which STRIDE category does this threat fall under?

When profiling an adversary, what does 'intent' refer to?

A threat actor is primarily motivated by financial gain and uses sophisticated malware to steal credit card data. Which category best describes this actor?

Keep studying — Threats and Defenses