A small non-profit organization that advocates for environmental policy has been targeted by a series of distributed denial-of-service (DDoS) attacks and website defacements. The attacks appear to be motivated by the organization's public stance. Based on adversary profiling, which threat actor type is most likely responsible, and what defensive measure should be prioritized?

Hacktivists; deploy a DDoS mitigation service and web application firewall

Cybercriminals; implement stronger encryption on the website

Insiders; revoke all employee access to the website

Nation-state actors; increase physical security at the office

A manufacturing company has a public-facing website, an employee VPN, and a partner portal. The security team wants to reduce the attack surface exposed to external adversaries. Which action would most effectively reduce the attack surface?

Increasing the frequency of vulnerability scans

Purchasing additional threat intelligence feeds

Disabling unnecessary services and ports on the public-facing systems

Implementing a honeypot to distract attackers

A security team has observed a series of attacks that use custom malware, sophisticated social engineering, and infrastructure hosted in multiple countries. The team is under pressure from executives to publicly name the responsible nation-state. Which consideration should the team prioritize before making a public attribution statement?

The geopolitical context and potential consequences of misattribution

The cost of the defensive countermeasures already deployed

The technical sophistication of the malware

The number of indicators of compromise collected

A threat intelligence team has produced a report on a new malware campaign and needs to share it with different audiences: executive leadership, system administrators, and incident responders. Which approach best aligns with the dissemination stage of the threat intelligence lifecycle?

Wait for more data before sharing to ensure accuracy

Send the same full technical report to all audiences

Tailor the report format and detail level for each audience

Publish the report only on the internal wiki and hope stakeholders find it

GIAC Information Security Fundamentals

Domain 3Objective 1

Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 4)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 16–20

16application · medium
A small non-profit organization that advocates for environmental policy has been targeted by a series of distributed denial-of-service (DDoS) attacks and website defacements. The attacks appear to be motivated by the organization's public stance. Based on adversary profiling, which threat actor type is most likely responsible, and what defensive measure should be prioritized?
Select an answer first
17application · medium
A manufacturing company has a public-facing website, an employee VPN, and a partner portal. The security team wants to reduce the attack surface exposed to external adversaries. Which action would most effectively reduce the attack surface?
Select an answer first
18expert · hard
A security team has observed a series of attacks that use custom malware, sophisticated social engineering, and infrastructure hosted in multiple countries. The team is under pressure from executives to publicly name the responsible nation-state. Which consideration should the team prioritize before making a public attribution statement?
Select an answer first
19application · medium
A threat intelligence team has produced a report on a new malware campaign and needs to share it with different audiences: executive leadership, system administrators, and incident responders. Which approach best aligns with the dissemination stage of the threat intelligence lifecycle?
Select an answer first
20foundation · easy
Which threat modeling methodology categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 4)

Questions 16–20

A manufacturing company has a public-facing website, an employee VPN, and a partner portal. The security team wants to reduce the attack surface exposed to external adversaries. Which action would most effectively reduce the attack surface?

A threat intelligence team has produced a report on a new malware campaign and needs to share it with different audiences: executive leadership, system administrators, and incident responders. Which approach best aligns with the dissemination stage of the threat intelligence lifecycle?

Which threat modeling methodology categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

Keep studying — Threats and Defenses