A utility company is assessing the threat of a terrorist group targeting its power grid. The group has limited technical capability but has expressed intent to cause disruption. The company has implemented multiple layers of security controls. What is the most appropriate threat assessment conclusion?

The threat is low because the company has security controls

The threat is high because the group has expressed intent

The threat is moderate because the group has intent but limited capability

The threat is negligible because the group is not sophisticated

A hospital is conducting a threat analysis for its patient records system. The team has identified that a ransomware group has been targeting healthcare organizations. The hospital has limited budget for security improvements. Which threat should be prioritized based on likelihood and impact?

Physical theft of devices, because it is easy to prevent

DDoS attack, because it can disrupt access to records

Ransomware, because the impact on patient care is high and the likelihood is elevated

Insider threat, because insiders have legitimate access

A financial institution is using threat modeling to assess a new online trading platform. The team has identified a threat where an attacker could manipulate stock prices by injecting false data. They also have threat intelligence indicating that such attacks are increasing. Which threat modeling approach would best help them understand and prioritize this threat?

Review the threat intelligence report and ignore the threat modeling

Use a vulnerability scanner to find the injection point

Conduct a penetration test to see if the injection is possible

Use STRIDE to categorize the threat as tampering and assess its impact on data integrity

GIAC Strategic Planning, Policy, and Leadership

Domain 3Objective 2

Understanding the Threats GSTRT Practice Questions (Page 4)

Part of the Business and Threat Context domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 9–16 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

5concepts

Questions 16–20

16expert · hard
A utility company is assessing the threat of a terrorist group targeting its power grid. The group has limited technical capability but has expressed intent to cause disruption. The company has implemented multiple layers of security controls. What is the most appropriate threat assessment conclusion?
Select an answer first
17expert · hard
A hospital is conducting a threat analysis for its patient records system. The team has identified that a ransomware group has been targeting healthcare organizations. The hospital has limited budget for security improvements. Which threat should be prioritized based on likelihood and impact?
Select an answer first
18expert · hard
A financial institution is using threat modeling to assess a new online trading platform. The team has identified a threat where an attacker could manipulate stock prices by injecting false data. They also have threat intelligence indicating that such attacks are increasing. Which threat modeling approach would best help them understand and prioritize this threat?
Select an answer first
19application · medium
A healthcare organization is using STRIDE threat modeling for its patient portal. The team is reviewing the data flow between the web server and the database. Which STRIDE category is most directly addressed by implementing encryption for data at rest and in transit?
Select an answer first
20foundation · easy
Which threat actor category is best described as individuals who use their authorized access to an organization's systems to cause harm or steal data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSTRT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSTRT” is a trademark of its owner, used for identification only.

Understanding the Threats GSTRT Practice Questions (Page 4)

Questions 16–20

A hospital is conducting a threat analysis for its patient records system. The team has identified that a ransomware group has been targeting healthcare organizations. The hospital has limited budget for security improvements. Which threat should be prioritized based on likelihood and impact?

A healthcare organization is using STRIDE threat modeling for its patient portal. The team is reviewing the data flow between the web server and the database. Which STRIDE category is most directly addressed by implementing encryption for data at rest and in transit?

Which threat actor category is best described as individuals who use their authorized access to an organization's systems to cause harm or steal data?

Keep studying — Business and Threat Context