Understanding the Threats GSTRT Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A multinational corporation has experienced a data breach. The investigation reveals that the attacker used credentials obtained from a phishing campaign. The attacker then moved laterally and exfiltrated sensitive data. The company's threat intelligence team has identified that the attack matches the TTPs of a known criminal group. Which threat actor category and motivation is most likely?

   • ANation-state actor motivated by espionage
   • BInsider motivated by revenge
   • CHacktivist group motivated by ideology
   • DCriminal group motivated by financial gain
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A large e-commerce company is conducting a threat analysis for its payment processing system. The system handles millions of transactions daily. The threat modeling team has identified a potential vulnerability in the payment API that could allow an attacker to manipulate transaction amounts. The company has limited security resources and must prioritize remediation efforts. The team has access to threat intelligence indicating that similar APIs in the retail sector have been actively exploited by financially motivated criminal groups. Which approach best balances the need to address the vulnerability with the company's resource constraints?

   • APrioritize remediation of the vulnerability based on the high likelihood of exploitation and the critical impact on financial transactions, while implementing temporary compensating controls.
   • BImmediately implement a web application firewall (WAF) rule to block all requests to the payment API until a permanent fix is developed.
   • CDefer remediation until a breach occurs, because the company has cyber insurance that will cover potential losses.
   • DConduct a full penetration test of the payment system to confirm exploitability before allocating resources to remediation.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A government contractor has observed a series of cyber incidents that appear to be coordinated and highly sophisticated, targeting specific projects related to national defense. The attacks have not been publicly claimed, and the techniques used are not widely known. Which threat actor category is most likely responsible?

   • AA criminal syndicate seeking financial gain through data theft and extortion.
   • BAn insider with a grudge against the contractor, using internal knowledge to cause damage.
   • CA hacktivist group promoting a political agenda against government contractors.
   • DA nation-state actor conducting espionage to gain strategic advantage in defense capabilities.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which type of threat intelligence provides context about specific threat actors, their tactics, techniques, and procedures (TTPs)?

   • ATechnical threat intelligence
   • BStrategic threat intelligence
   • CTactical threat intelligence
   • DOperational threat intelligence
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A financial services firm is conducting a threat analysis for its new mobile banking application. The threat modeling team has identified a vulnerability in the API that could allow unauthorized fund transfers. They are now assessing the likelihood and impact of this threat being exploited. Which approach best aligns with a structured threat analysis process?

   • AFocus only on the technical exploitability of the API, because likelihood is determined by the ease of exploitation and impact is secondary to technical severity.
   • BAssign a risk score based on the vulnerability's CVSS base score alone, since it is a standardized measure of severity.
   • CEstimate likelihood by reviewing threat intelligence for active exploitation of similar APIs in the financial sector, and impact by analyzing the potential financial and reputational damage to the firm.
   • DUse a qualitative rating of 'high' for both likelihood and impact because the vulnerability involves financial loss, without further analysis.
   Reveal Solution Discussion Select an answer first