Understanding the Threats GSTRT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard · select all that apply

   A large retail company is integrating threat intelligence into its security program. The company has a distributed infrastructure and a limited security team. The goal is to improve threat detection and response while minimizing false positives and analyst workload. Which of the following strategies best achieve this goal? (Select all that apply.)

   • AUse threat intelligence to enrich alerts in the SIEM, providing context that helps analysts prioritize true positives.
   • BAutomatically block all IP addresses from a commercial threat intelligence feed at the perimeter firewall.
   • CIntegrate threat intelligence into the SOAR platform to automate responses to high-confidence indicators.
   • DManually correlate threat intelligence with internal logs on a weekly basis to identify trends.
   • EShare threat intelligence with industry peers through an ISAC to gain insights into emerging threats.
   Check answers Discussion Select an answer first
2. 22application · medium

   A software company is using the PASTA threat modeling methodology to assess a new cloud-based application. The team is in the stage of identifying potential attack vectors. Which activity is most aligned with this stage?

   • ACalculating the financial impact of a potential data breach.
   • BReviewing the organization's security policies and procedures.
   • CDecomposing the application into its components and data flows to identify entry points.
   • DSelecting a threat intelligence feed to monitor for emerging threats.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A manufacturing company is conducting a threat analysis for its industrial control systems (ICS). The team has identified that a disgruntled former employee with knowledge of the systems could cause physical damage. They need to prioritize this threat. Which factor should be most heavily weighted in their risk assessment?

   • AThe number of similar threats in the industry
   • BThe likelihood of the former employee being caught
   • CThe cost of implementing new security controls
   • DThe potential impact on human safety and operational continuity
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A global bank's threat intelligence team receives a report from a trusted vendor about a new malware family targeting the banking sector. The report includes IOCs and TTPs. The team also has internal data showing that a similar malware was detected in a non-production environment last month. The bank's leadership wants to prioritize actions. What is the most effective approach?

   • ACorrelate the vendor IOCs with internal logs and prioritize based on the TTPs
   • BImmediately block all IPs from the vendor report
   • CDeploy the IOCs to all security tools without further analysis
   • DWait for additional intelligence before taking any action
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which step in a structured threat analysis process involves gathering details about a threat's capabilities and methods?

   • AAssessing likelihood
   • BAssessing impact
   • CCharacterizing threats
   • DIdentifying threats
   Reveal Solution Discussion Select an answer first