Understanding the Threats GSTRT Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security team is using the OCTAVE threat modeling methodology to assess risks to the organization's critical assets. The team has identified a threat that involves a disgruntled employee leaking sensitive customer data. Which step in the OCTAVE methodology is most relevant to this threat?

   • AImplementing a data loss prevention (DLP) solution to prevent data exfiltration.
   • BSelecting a threat intelligence feed to monitor for external threats.
   • CIdentifying the organization's critical assets and their associated risks.
   • DConducting a penetration test to identify vulnerabilities in the network.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which category of threat actor is most commonly associated with conducting espionage and intellectual property theft to advance a country's strategic interests?

   • ANation-state actors
   • BTerrorists
   • CInsiders
   • DHacktivists
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A healthcare organization is using STRIDE to threat model a new patient portal that allows patients to view and update their personal health information. The team is identifying threats in the 'Information Disclosure' category. Which scenario best exemplifies an Information Disclosure threat in this context?

   • AAn attacker intercepts the patient's session token and uses it to view the patient's medical records.
   • BAn attacker sends a forged request to the portal to change the patient's password.
   • CAn attacker modifies the patient's medication list in the portal, causing incorrect information to be displayed.
   • DAn attacker causes the portal to become unresponsive, preventing patients from accessing their records.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which threat modeling approach is best suited for prioritizing threats based on their potential business impact and the likelihood of exploitation?

   • AAsset-centric threat modeling
   • BRisk-based threat modeling
   • CAttacker-centric threat modeling
   • DSoftware-centric threat modeling
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A global manufacturing company is integrating threat intelligence into its security operations. The company has a mature security program but limited budget for new tools. The security team must decide how to incorporate threat intelligence to improve detection and response without overburdening analysts. Which approach best meets the company's needs?

   • ASubscribe to a commercial threat intelligence feed and automatically block all IP addresses listed in the feed.
   • BIntegrate a threat intelligence platform (TIP) that automates the collection and correlation of intelligence from multiple sources, and use it to enrich alerts and support analyst investigations.
   • CUse open-source threat intelligence feeds and manually correlate them with internal security event logs on a weekly basis.
   • DRely solely on the security team's existing knowledge and experience, since threat intelligence feeds are often outdated and unreliable.
   Reveal Solution Discussion Select an answer first