Understanding the Threats GSTRT Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A financial institution has detected unusual activity on its network. The activity appears to originate from an internal employee's workstation and involves the exfiltration of customer data. The employee has access to sensitive information as part of their job. Which threat actor category best describes this scenario?

   • AAn insider threat, because the employee has legitimate access and is misusing it to exfiltrate data.
   • BA nation-state actor, because the exfiltration is sophisticated and targeted.
   • CA criminal group, because the exfiltration is likely for financial gain.
   • DA hacktivist group, because the data exfiltration is likely for ideological reasons.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A government agency is conducting a threat analysis for its citizen-facing portal. The portal allows citizens to access personal information and submit forms. The agency has identified a potential threat that could allow an attacker to access other citizens' data. The agency has a high risk tolerance for service disruption but a low tolerance for data breaches. The threat modeling team must decide how to prioritize this threat. Which approach best aligns with the agency's risk tolerance?

   • AConduct a full risk assessment to determine the exact likelihood and impact before making a decision.
   • BPrioritize the threat because the impact on data confidentiality is high, even if the likelihood is moderate.
   • CAddress the threat only if it is also likely to cause service disruption, since the agency can tolerate data breaches.
   • DDefer the threat because the likelihood is moderate and the agency has a high tolerance for service disruption.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A financial services firm is conducting a threat analysis for its new mobile banking application. The security team has identified a vulnerability in the API gateway. They need to determine the likelihood and impact of exploitation. Which step of the threat analysis process should they perform next?

   • AImmediately implement a patch for the vulnerability
   • BDocument the vulnerability in the risk register
   • CCharacterize the threat actor who might exploit the vulnerability
   • DAssess the likelihood and impact of the identified vulnerability
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A multinational corporation's security operations center receives threat intelligence indicating that a specific advanced persistent threat (APT) group is targeting companies in its industry. The intelligence includes indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs). What is the most effective initial use of this intelligence?

   • AStore the intelligence report for future reference
   • BUpdate detection rules and hunt for the IOCs in the environment
   • CBlock all IP addresses listed in the intelligence report
   • DShare the intelligence with all employees to raise awareness
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A large organization is integrating threat intelligence into its risk management process. The security team has access to a commercial threat intelligence platform that provides real-time alerts. However, the alerts are not integrated with the organization's asset inventory. What is the most effective way to use this intelligence?

   • AStore the intelligence for future analysis
   • BMap the intelligence to the asset inventory to identify vulnerable assets
   • CForward all alerts to the security operations center for manual review
   • DBlock all indicators from the intelligence feed
   Reveal Solution Discussion Select an answer first