Understanding the Threats GSTRT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A regional utility company has experienced a series of targeted phishing emails that reference recent board decisions and internal project code names. The emails originate from a known cyber-espionage group with ties to a foreign government. The company's leadership asks the security team to prioritize defensive actions. Which threat actor category and motivation best describe this situation?

   • AHacktivists motivated by ideological opposition
   • BCriminal syndicates motivated by financial gain
   • CNation-state actors motivated by espionage
   • DInsiders motivated by personal grievance
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A large e-commerce company is using threat modeling to assess its new payment processing system. The team has limited resources and must prioritize threats. They have identified several threats, including a SQL injection vulnerability, a distributed denial of service (DDoS) risk, and a potential insider threat. Which approach should they use to prioritize these threats?

   • AUse a risk matrix that scores each threat on likelihood and impact
   • BPrioritize the threat that is easiest to mitigate
   • CAddress all threats equally
   • DPrioritize the threat with the highest media attention
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A government agency is conducting a threat analysis for its citizen portal. The agency has identified that a foreign nation-state actor has the capability to exploit a known vulnerability in the portal. The vulnerability is not yet patched. The agency has limited resources and must decide whether to patch the vulnerability or implement a compensating control. What is the most important factor in this decision?

   • AThe cost of the patch versus the cost of the compensating control
   • BThe availability of the vendor's patch
   • CThe reputation of the nation-state actor
   • DThe likelihood of exploitation and the impact on citizen data
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A non-profit environmental organization discovers that its website has been defaced with political messages and its email server has been used to send propaganda. The organization has no financial assets that would attract cybercriminals. Which threat actor category and motivation is most likely responsible?

   • AInsiders motivated by revenge
   • BNation-state actors motivated by espionage
   • CHacktivists motivated by ideology
   • DCriminal groups motivated by financial gain
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which motivation is most commonly associated with organized criminal groups conducting ransomware attacks?

   • AFinancial gain
   • BIdeology
   • CDisruption
   • DEspionage
   Reveal Solution Discussion Select an answer first