Understanding the Threats GSTRT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A non-profit environmental organization has been targeted by a series of distributed denial-of-service (DDoS) attacks and website defacements. The attacks appear to be coordinated and are accompanied by public statements criticizing the organization's advocacy work. Which threat actor category is most likely responsible?

   • AA nation-state actor seeking to disrupt the organization's operations for geopolitical reasons.
   • BAn insider with a personal grudge against the organization, using internal access to launch attacks.
   • CA criminal group attempting to extort money from the organization by threatening further attacks.
   • DA hacktivist group using disruptive attacks to promote a political agenda against the organization's cause.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A technology company is integrating threat intelligence from multiple sources, including open-source feeds, commercial feeds, and industry sharing groups. The team notices that the open-source feeds generate many false positives, while the commercial feeds are more accurate but expensive. The company has a limited security budget. What is the most effective strategy?

   • AUse commercial feeds for critical assets and open-source feeds for general awareness
   • BUse only open-source feeds to save money
   • CStop using threat intelligence feeds altogether
   • DUse only commercial feeds for all assets
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a structured threat analysis process, which step involves determining the potential damage a threat could cause to an organization?

   • ACharacterizing threats
   • BAssessing likelihood
   • CAssessing impact
   • DIdentifying threats
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security architect is using the STRIDE methodology to threat model a new online banking application. The team is analyzing the 'Elevation of Privilege' category. Which scenario best represents an Elevation of Privilege threat?

   • AAn attacker intercepts and reads the bank account numbers of other users.
   • BAn attacker exploits a buffer overflow in the application to execute code with administrative privileges.
   • CAn attacker sends a crafted request to the server to impersonate another user.
   • DAn attacker modifies the transaction history of another user.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations center (SOC) is incorporating threat intelligence into its daily operations. The SOC receives a daily feed of indicators of compromise (IOCs) from a trusted source. The team wants to use this intelligence to improve its detection capabilities. Which action best leverages this threat intelligence?

   • AStore the IOCs in a spreadsheet for future reference, since they are only useful for post-incident analysis.
   • BManually review each IOC and add them to the SIEM as correlation rules.
   • CIntegrate the IOC feed into the SIEM to automatically generate alerts when indicators are observed in network traffic.
   • DAutomatically block all IP addresses from the IOC feed at the firewall.
   Reveal Solution Discussion Select an answer first