Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   What is the 'attack surface' of an organization?

   • AThe total set of points where an attacker can try to enter or extract data
   • BThe number of security tools deployed in the network
   • CThe list of known vulnerabilities in software
   • DThe physical area of the data center
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A security team is investigating a potential compromise. They have identified the following artifacts: (1) a file hash of a known malware sample, (2) a suspicious registry key that persists across reboots, (3) a network connection to a domain that was registered 3 days ago, and (4) a user account that logged in at 3:00 AM from an unusual location. The team needs to determine which artifacts are most reliable as indicators of compromise (IoCs) for detection across the enterprise. Which combination should they prioritize?

   • AThe unusual login is the most reliable because it indicates a compromised account
   • BThe network domain and the unusual login
   • CThe file hash and the registry key
   • DAll four artifacts are equally reliable
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A security analyst is responsible for the threat intelligence lifecycle. The team has just received a large volume of raw data from multiple sources, including open-source feeds, internal logs, and commercial intelligence reports. The data is noisy and contains many false positives. What is the next step in the lifecycle the analyst should perform?

   • AProcessing the data to convert it into a usable and consistent format
   • BCollecting additional data from more sources
   • CApplying the data directly to defensive controls
   • DDisseminating the data to all security teams immediately
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A security analyst is reviewing a suspicious email that contains a link to a website that hosts a malicious document. The analyst wants to identify indicators of compromise that can be used to detect other instances of this campaign across the organization. Which combination of indicators would be most effective?

   • AThe sender's email address and the subject line of the email
   • BThe URL of the malicious website and the hash of the malicious document
   • CThe time the email was sent and the recipient's name
   • DThe IP address of the recipient's mail server
   Reveal Solution Discussion Select an answer first
6. 55foundation · easy

   Which of the following is a common attack vector?

   • AIntrusion detection systems
   • BPhishing emails
   • CEncryption protocols
   • DFirewall rules
   Reveal Solution Discussion Select an answer first