Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   An organization has identified that a nation-state actor is targeting their intellectual property through spear-phishing and exploiting unpatched software. Which defensive strategy would be most effective?

   • ADisabling all logging to reduce data exposure
   • BImplementing a robust patch management program and advanced email security
   • CIncreasing the number of public-facing servers
   • DUsing only open-source software
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A regional hospital has experienced a series of targeted phishing emails that use medical terminology and reference specific local health conferences. The emails originate from a known hacktivist collective that has previously defaced websites of other hospitals. The hospital's security team is assessing the threat to prioritize defenses. Which characterization best describes this adversary?

   • AA financially motivated cybercriminal organization seeking to monetize stolen data
   • BA highly resourced state-sponsored group conducting espionage for strategic advantage
   • CAn insider with legitimate access and a grudge against the hospital
   • DA low-skill actor with limited resources but high motivation to cause reputational damage
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which threat modeling approach uses a tree-like diagram to show how an attacker might achieve a goal through various sub-goals and attack paths?

   • ASTRIDE
   • BAttack trees
   • CDREAD
   • DCVSS
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which threat actor type is most likely to be motivated by ideological or political beliefs and typically uses attacks to promote a cause?

   • ACybercriminal
   • BHacktivist
   • CInsider
   • DNation-state
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A security team is analyzing a series of intrusions. They notice that the attacker uses the same command-line tools, follows the same lateral movement pattern, and exfiltrates data to the same external IP addresses across multiple incidents. The team wants to develop a detection strategy that anticipates future activity from this adversary. What should they focus on?

   • AThe specific malware hashes observed in the incidents
   • BThe IP addresses of the exfiltration servers
   • CThe adversary's tactics, techniques, and procedures (TTPs)
   • DThe time of day the attacks occur
   Reveal Solution Discussion Select an answer first