Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An incident response team is reviewing a breach where the attacker used a previously unknown exploit for a zero-day vulnerability, then used native Windows tools to move laterally, and finally encrypted files and demanded a ransom. The team wants to improve detection for future incidents. Which approach would be most effective?

   • ARely solely on signature-based antivirus to detect the zero-day exploit
   • BDisable all outbound network traffic to prevent data exfiltration
   • CFocus on behavioral analytics to detect lateral movement and ransomware activity
   • DBlock all PowerShell usage to prevent lateral movement
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A threat intelligence team has collected raw data from various sources, including open-source feeds, internal logs, and industry reports. They have converted the data into a standardized format and are now analyzing it to identify patterns and produce actionable intelligence. Which stage of the threat intelligence lifecycle are they currently in?

   • ADissemination
   • BAnalysis
   • CProcessing
   • DCollection
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a 'false flag' in the context of cyber attack attribution?

   • AA security tool that generates decoy traffic
   • BA legitimate attack that is reported incorrectly
   • CA type of malware that changes its signature
   • DAn attempt to make an attack appear to be from a different actor
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security operations team is investigating a potential compromise. They have identified a suspicious process running on a server that is making outbound connections to an IP address that is not on any threat intelligence feed. The process name is similar to a legitimate Windows service. What should the team do to determine if this is a true indicator of compromise?

   • AReboot the server to clear the process
   • BImmediately block the IP address at the firewall
   • CCompare the process's behavior and file hash against known-good baselines
   • DIgnore the alert because the IP is not on any threat feed
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A government contractor has discovered that a foreign intelligence service has been attempting to steal classified project information. The attacks are highly sophisticated, use custom malware, and are persistent over many months. The contractor wants to implement defensive countermeasures. Which approach is most appropriate for this threat actor type?

   • ADeploying a web application firewall to protect the public website
   • BIncreasing physical security at the facility
   • CFocusing on user awareness training to prevent phishing
   • DImplementing strong endpoint detection and response (EDR) and network segmentation
   Reveal Solution Discussion Select an answer first