Understanding the Threats GSTRT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A multinational corporation's security operations center is evaluating threat intelligence feeds to improve its strategic decision-making. The team wants to prioritize intelligence that directly informs the organization's risk posture. Which type of threat intelligence is most relevant for this purpose?

   • AOperational intelligence, such as details of specific attack campaigns and their techniques, because it helps understand current threats.
   • BOpen-source intelligence (OSINT), because it is freely available and provides a broad view of potential threats.
   • CStrategic intelligence, such as analysis of threat actor motivations, capabilities, and long-term trends, because it supports risk management and resource allocation decisions.
   • DTactical intelligence, such as indicators of compromise (IOCs) and malware hashes, because it provides immediate detection capabilities.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A defense contractor discovers that a foreign intelligence service has been attempting to recruit employees with access to classified projects. The attempts have been sophisticated and persistent. Which threat actor motivation is most likely driving this activity?

   • AIdeological opposition to the contractor's work
   • BDisruption of the contractor's operations
   • CFinancial gain through selling secrets
   • DEspionage to obtain classified information
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A hacktivist group defaces a government website to protest a new law. Which motivation best describes this threat actor's primary driver?

   • AIdeology
   • BDisruption
   • CFinancial gain
   • DEspionage
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A government agency is assessing the threat of a terrorist group targeting its public-facing website. The group has previously conducted low-sophistication attacks. The website contains no sensitive data but is a key public service. What is the most appropriate risk assessment approach?

   • AIgnore the threat because the website has no sensitive data
   • BFocus only on the likelihood of attack, not the impact
   • CWeigh the low likelihood of a sophisticated attack against the high impact of service disruption
   • DAssume the threat is high because it is a terrorist group
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A defense contractor is evaluating threat intelligence sources to support its strategic planning. The company operates in a highly regulated environment and faces threats from nation-state actors. The security team must choose a threat intelligence source that provides reliable, actionable information while respecting contractual and regulatory constraints. Which source is most appropriate?

   • AOpen-source intelligence (OSINT) from social media and public forums, because it is free and provides early warning of emerging threats.
   • BA commercial threat intelligence feed that provides real-time indicators of compromise (IOCs) and is widely used in the industry.
   • CAn information sharing and analysis center (ISAC) specific to the defense industrial base, which provides vetted intelligence and facilitates collaboration with peers.
   • DA threat intelligence report from a cybersecurity vendor that is publicly available and provides general trends.
   Reveal Solution Discussion Select an answer first