A software company is designing a new customer-facing web application that will store payment card data. The security team wants to systematically identify threats during the design phase. They have limited time and need a structured approach that focuses on the application's components and data flows. Which threat modeling methodology should they use, and what is its primary output?

STRIDE; a categorized list of threats per component and data flow

DREAD; a prioritized list of threats based on risk ratings

MITRE ATT&CK; a matrix of adversary techniques mapped to the application

Attack trees; a diagram of possible attack paths from an attacker's goal

Which of the following is an example of an indicator of compromise (IoC)?

A server being rebooted for maintenance

An employee printing a document

A known malicious file hash appearing on a host

A financial services firm is conducting a threat modeling exercise for its online banking platform. The team wants to identify threats that could lead to unauthorized access to customer accounts. They decide to use an attack tree. What is the first step they should take?

Collect indicators of compromise from recent incidents

Assign a DREAD score to each branch of the tree

Identify all possible countermeasures for each threat

Define the attacker's ultimate goal, such as unauthorized account access

Which combination of factors is most commonly used to profile a potential adversary in cybersecurity?

Geographic location, language, and time zone

Network topology, firewall rules, and encryption standards

Operating system, software versions, and patch levels

Capabilities, intent, and resources

A security team is building a threat intelligence program. They have limited staff and must decide how to allocate resources. The team currently spends most of its time collecting raw data from many sources, but the analysts are overwhelmed and cannot produce actionable intelligence. Which change would best improve the program's effectiveness?

Reduce the number of data sources and focus on high-quality, relevant feeds

Increase the frequency of data collection from all sources

Skip the processing step to save time

Automate the dissemination of raw data to all stakeholders

GIAC Information Security Fundamentals

Domain 3Objective 1

Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 2)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 6–10

6application · medium
A software company is designing a new customer-facing web application that will store payment card data. The security team wants to systematically identify threats during the design phase. They have limited time and need a structured approach that focuses on the application's components and data flows. Which threat modeling methodology should they use, and what is its primary output?
Select an answer first
7foundation · easy
Which of the following is an example of an indicator of compromise (IoC)?
Select an answer first
8application · medium
A financial services firm is conducting a threat modeling exercise for its online banking platform. The team wants to identify threats that could lead to unauthorized access to customer accounts. They decide to use an attack tree. What is the first step they should take?
Select an answer first
9foundation · easy
Which combination of factors is most commonly used to profile a potential adversary in cybersecurity?
Select an answer first
10expert · hard
A security team is building a threat intelligence program. They have limited staff and must decide how to allocate resources. The team currently spends most of its time collecting raw data from many sources, but the analysts are overwhelmed and cannot produce actionable intelligence. Which change would best improve the program's effectiveness?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 2)

Questions 6–10

Which of the following is an example of an indicator of compromise (IoC)?

A financial services firm is conducting a threat modeling exercise for its online banking platform. The team wants to identify threats that could lead to unauthorized access to customer accounts. They decide to use an attack tree. What is the first step they should take?

Which combination of factors is most commonly used to profile a potential adversary in cybersecurity?

Keep studying — Threats and Defenses