Adversary Analysis and Threat Frameworks GISF Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A security team is analyzing an intrusion where the attacker used a sophisticated zero-day exploit, custom malware, and operational security measures such as Tor and encrypted communications. The malware sample contains code strings in Russian and was also used in a previous campaign attributed to a known cybercriminal group. However, the attack's sophistication suggests possible nation-state involvement. The team must decide how to report attribution to management. Which approach is most appropriate?

   • AReport the attack as likely nation-state due to the zero-day and custom malware
   • BReport the attack as a false flag by a cybercriminal group trying to mimic a nation-state
   • CReport the attack with confidence levels and multiple hypotheses, avoiding definitive attribution
   • DReport the attack as definitely the work of the known cybercriminal group because of the code reuse
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company is threat modeling a new payment processing system. The team has limited resources and must prioritize which threats to address. They have identified the following threats: (A) an attacker could steal credit card data in transit, (B) an attacker could tamper with transaction amounts, (C) an attacker could cause a denial of service, and (D) an attacker could impersonate a legitimate user. The team wants to use DREAD to prioritize these threats. Which threat would likely receive the highest overall DREAD score?

   • ACausing a denial of service
   • BImpersonating a legitimate user
   • CStealing credit card data in transit
   • DTampering with transaction amounts
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security analyst is investigating a breach and finds that the attacker used a VPN service, leveraged a publicly available exploit kit, and left behind a malware sample that shares code with a known cybercriminal group's tools. The analyst is preparing a report for management. Which statement best reflects the appropriate conclusion about attribution?

   • AThe attack is definitely the work of a hacktivist group because they often use public tools
   • BThe attack is likely from a nation-state because of the use of a VPN
   • CThe attack can be attributed to the cybercriminal group with high confidence based on the code similarity
   • DThe attack cannot be definitively attributed to a specific actor based solely on these indicators
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security team is profiling potential adversaries for a defense contractor that handles classified projects. The team has identified the following threat actors: (A) a nation-state with advanced cyber capabilities, (B) a hacktivist group opposed to the company's projects, (C) a cybercriminal syndicate seeking financial gain, and (D) a disgruntled employee with access to sensitive data. The company must prioritize its defenses based on the most likely and impactful threats. Which actor should be the primary focus?

   • AThe nation-state, because they have the highest capability and intent to steal classified data
   • BThe disgruntled employee, because insiders are always the greatest threat
   • CThe cybercriminal syndicate, because they are financially motivated and always active
   • DThe hacktivist group, because they are most likely to attack due to ideological opposition
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A threat intelligence team is building a new intelligence program. They have limited staff and budget. They need to decide which sources to prioritize for collection. The team has access to: (1) open-source threat feeds, (2) a commercial threat intelligence subscription, (3) internal logs from their own network, and (4) information sharing partnerships with other organizations in their sector. Which combination of sources would provide the most balanced and actionable intelligence for their organization?

   • ACommercial subscription and information sharing partnerships
   • BOnly the commercial subscription because it is the most comprehensive
   • COpen-source feeds and internal logs
   • DAll four sources, prioritizing internal logs and sector-specific sharing
   Reveal Solution Discussion Select an answer first