A software development company is using threat modeling to assess a new web application. The team has created a data flow diagram and identified that user input is passed directly to a SQL query. Which threat modeling technique would best help them identify and prioritize this vulnerability?

Reviewing the application's source code for SQL injection

Using STRIDE to categorize the threat as tampering or information disclosure

Conducting a penetration test to exploit the SQL injection

Using a vulnerability scanner to identify the SQL injection

A media company has been targeted by a hacktivist group that disagrees with its editorial stance. The group has launched DDoS attacks and defaced the company's website. The company's security team is considering how to respond. Which approach best balances the need to maintain operations and address the threat?

Launch a counter-attack against the hacktivist group

Shut down the website until the group stops

Implement DDoS mitigation and web application firewalls while monitoring for further activity

Ignore the attacks because they are only hacktivists

A retail company is integrating threat intelligence feeds into its SIEM. The security team notices that the feeds contain a high volume of indicators with low fidelity. What is the most appropriate action to improve the effectiveness of the intelligence integration?

Disable all alerts from the threat intelligence feeds

Remove the threat intelligence feeds entirely

Tune the SIEM rules to reduce false positives and correlate with internal context

Increase the severity of all alerts from the feeds

GIAC Strategic Planning, Policy, and Leadership

Domain 3Objective 2

Understanding the Threats GSTRT Practice Questions (Page 6)

Part of the Business and Threat Context domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 9–16 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

5concepts

Questions 26–30

26foundation · easy
Which threat modeling framework is commonly used to systematically identify and prioritize threats by focusing on application components such as data flows, trust boundaries, and entry points?
Select an answer first
27foundation · easy
Which threat intelligence source is most likely to provide timely, actionable indicators of compromise (IOCs) such as malicious IP addresses and file hashes?
Select an answer first
28application · medium
A software development company is using threat modeling to assess a new web application. The team has created a data flow diagram and identified that user input is passed directly to a SQL query. Which threat modeling technique would best help them identify and prioritize this vulnerability?
Select an answer first
29expert · hard
A media company has been targeted by a hacktivist group that disagrees with its editorial stance. The group has launched DDoS attacks and defaced the company's website. The company's security team is considering how to respond. Which approach best balances the need to maintain operations and address the threat?
Select an answer first
30application · medium
A retail company is integrating threat intelligence feeds into its SIEM. The security team notices that the feeds contain a high volume of indicators with low fidelity. What is the most appropriate action to improve the effectiveness of the intelligence integration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSTRT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSTRT” is a trademark of its owner, used for identification only.

Understanding the Threats GSTRT Practice Questions (Page 6)

Questions 26–30

Which threat modeling framework is commonly used to systematically identify and prioritize threats by focusing on application components such as data flows, trust boundaries, and entry points?

Which threat intelligence source is most likely to provide timely, actionable indicators of compromise (IOCs) such as malicious IP addresses and file hashes?

A software development company is using threat modeling to assess a new web application. The team has created a data flow diagram and identified that user input is passed directly to a SQL query. Which threat modeling technique would best help them identify and prioritize this vulnerability?

A retail company is integrating threat intelligence feeds into its SIEM. The security team notices that the feeds contain a high volume of indicators with low fidelity. What is the most appropriate action to improve the effectiveness of the intelligence integration?

Keep studying — Business and Threat Context