Threat Informed Defense GMON Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In the context of security monitoring, what does 'threat informed' specifically mean?

   • AMonitoring relies exclusively on commercial threat intelligence feeds
   • BMonitoring strategies are designed around the known behaviors and objectives of potential attackers
   • CMonitoring is driven by the organization's risk appetite and business priorities
   • DMonitoring decisions are based on the latest vulnerability scan results
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A detection engineer is reviewing a rule that was created based on a threat intelligence report. The rule has a high false positive rate because the technique is also used by legitimate software. The engineer wants to maintain detection while reducing noise. Which approach is most aligned with threat-informed detection engineering?

   • AKeep the rule as is and accept the false positives.
   • BRefine the rule by adding additional context from the threat report, such as specific command-line arguments or parent process relationships.
   • CDelete the rule because it is causing too many alerts.
   • DIncrease the alert threshold so that only repeated occurrences trigger an alert.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC has limited resources and cannot run a full red team exercise. They want to validate their detection coverage for a specific threat actor. They have a test environment and access to an adversary emulation tool. Which approach best balances thoroughness and resource constraints?

   • AReview the threat intelligence report and manually map the techniques to existing detection rules.
   • BDeploy a honeypot and wait for the threat actor to attack it.
   • CUse the adversary emulation tool to execute the specific techniques that the threat actor is known to use, and then verify that the corresponding detections fire.
   • DRun a full red team exercise in the test environment, simulating the entire attack chain.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How does threat intelligence primarily inform monitoring strategies?

   • ABy automatically patching systems to prevent attacks
   • BBy providing a list of all known vulnerabilities in the environment
   • CBy replacing the need for human analysis of security events
   • DBy identifying which indicators of compromise and adversary behaviors to look for in telemetry
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security architect is designing a monitoring strategy for a financial institution. The institution is a likely target for financially motivated threat actors. How should the architect apply threat-informed defense?

   • APrioritize monitoring for the tactics and techniques commonly used by financially motivated adversaries.
   • BFocus monitoring on compliance requirements only.
   • CImplement a generic monitoring strategy that covers all possible threats equally.
   • DUse only commercial threat intelligence feeds because they are more reliable.
   Reveal Solution Discussion Select an answer first