Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team has analyzed a recent advanced persistent threat (APT) campaign using MITRE ATT&CK. The campaign involves: (1) spear-phishing with a malicious macro, (2) using PowerShell to download a C2 agent, (3) abusing Windows Management Instrumentation (WMI) for persistence, and (4) using a legitimate cloud service for data exfiltration. The team must select defensive controls to mitigate the most critical stages. Which combination of controls would be most effective?

   • AEmail gateway filtering, PowerShell logging and constraint mode, WMI activity monitoring, and cloud access security broker (CASB)
   • BOnly user awareness training and strong passwords
   • COnly network segmentation and access controls
   • DOnly endpoint antivirus and a firewall
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of a tactic in the context of TTPs?

   • AUsing a specific malware variant
   • BSending a phishing email with a specific subject line
   • CInitial Access
   • DExploiting a particular vulnerability
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In the threat intelligence lifecycle, what is the purpose of the 'processing' stage?

   • ATo collect data from various sources
   • BTo distribute intelligence to consumers
   • CTo define the intelligence requirements
   • DTo convert raw data into a format that can be analyzed
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A regional hospital has experienced repeated, low-sophistication phishing emails that use publicly available information about staff to craft convincing lures. The emails demand urgent action but contain no malware and are sent from free webmail accounts. The hospital's security team has limited budget and must prioritize defensive controls. Based on adversary profiling, which threat actor type is most likely behind these attacks, and which control should be prioritized?

   • ANation-state actors; deploy an on-premises intrusion prevention system
   • BInsiders; enforce stricter access control on the hospital's electronic health records
   • CCybercriminals; implement email filtering and staff security awareness training
   • DHacktivists; strengthen the hospital's public-facing web application firewall
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In cybersecurity, what do TTPs describe?

   • AThe policies and procedures for incident response
   • BThe network protocols used in a data center
   • CThe tools used to defend a network
   • DThe specific behaviors and methods an adversary uses to conduct an attack
   Reveal Solution Discussion Select an answer first