Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company's security team is reviewing its attack surface after deploying a new web application that allows customers to upload files. The application is hosted on a public cloud server with a public IP address. Which of the following is the most direct attack vector introduced by this deployment?

   • AInsider threat from a disgruntled employee
   • BMalicious file upload leading to code execution
   • CSocial engineering of customers
   • DPhysical theft of the server
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security team has identified a cyber attack that uses tools and techniques that are publicly attributed to a known advanced persistent threat (APT) group. However, the team also notices that the attack infrastructure includes servers in a country that is not typically associated with that group. What should the team conclude about attribution?

   • AThe attack is likely from a different actor because the infrastructure is in an unusual country
   • BThe attack is definitely from the APT group because the tools match
   • CAttribution is uncertain and requires further analysis of TTPs and other evidence
   • DThe attack is a false flag designed to implicate the APT group
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Based on adversary analysis, which defensive countermeasure is most appropriate to mitigate the risk of phishing attacks?

   • AImplementing email filtering and user awareness training
   • BDisabling all network firewalls
   • CIncreasing the number of user accounts
   • DEncrypting all data at rest
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An incident responder is analyzing a breach where the attacker gained access via a phishing email, used a legitimate administrative tool for lateral movement, and then encrypted files. The responder wants to use the Cyber Kill Chain to identify where detection could have prevented the attack. Which stage of the Kill Chain should the responder focus on to improve prevention?

   • ADelivery, by implementing email filtering and user awareness training
   • BActions on Objectives, by monitoring for file encryption
   • CCommand and Control, by blocking known C2 domains
   • DWeaponization, by analyzing the malware used
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A healthcare organization is conducting a threat model for its new patient portal. The team is concerned about unauthorized access to patient data. They decide to use DREAD to assess the risks of identified threats. What is the primary purpose of using DREAD in this context?

   • ATo map threats to specific attack vectors
   • BTo determine the attacker's motivation
   • CTo prioritize threats based on risk ratings
   • DTo identify all possible threats in the system
   Reveal Solution Discussion Select an answer first