Threat Modeling and Threat Landscape CRISC Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A risk manager is reviewing the threat landscape for a critical infrastructure organization. The organization has seen an increase in attacks from nation-state actors, but also a rise in hacktivist activity. The risk manager needs to update the risk assessment to reflect these different threat actors. Which approach best captures the nuances of these threats?

   • AFocus only on nation-state actors because they are more sophisticated
   • BDocument each threat actor type separately, noting their motivations, capabilities, and likely targets
   • CCombine all threat actors into a single 'external threat' category
   • DUse a generic threat feed and apply it to all assets
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A multinational corporation is updating its risk assessment. The security team observes a rise in ransomware attacks targeting similar organizations in their industry, with attackers using new evasion techniques. They need to incorporate this evolving threat landscape into their risk analysis. Which action best integrates this external threat intelligence into the risk assessment?

   • AIncrease the likelihood rating for ransomware scenarios in the risk register
   • BIgnore the trend until it affects the organization directly
   • CReclassify ransomware as a low-impact risk
   • DAdd a new control to prevent all ransomware attacks
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A risk analyst is updating the organization's threat landscape profile. They notice that a previously low-profile threat actor group has become more active and is now targeting the organization's sector with sophisticated phishing campaigns. The analyst needs to document this change for the risk assessment. Which component of the threat landscape is the analyst primarily updating?

   • AIncident response procedures
   • BThreat actor capabilities and motivations
   • CCompliance requirements
   • DVulnerability database entries
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security architect is evaluating a new payment processing system. The team needs to understand the various ways an attacker could compromise the system, starting from a high-level goal and breaking it down into specific attack steps. They also want to visually represent these paths to communicate with stakeholders. Which threat modeling approach is best suited for this?

   • AAttack trees
   • BDREAD
   • CCVSS
   • DSTRIDE
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is conducting a threat modeling exercise for a new cloud-based application. They have identified several threats and need to document them in a way that is useful for the risk assessment. The team is considering whether to use a structured format like a threat model document or a simple spreadsheet. Which approach is more effective for ensuring the threat modeling outputs are actionable?

   • AUse a structured threat model document that includes threat descriptions, affected components, and potential mitigations
   • BStore the threats in a shared folder without any structure
   • CVerbally communicate the threats to the risk team without documentation
   • DUse a simple spreadsheet with just threat names
   Reveal Solution Discussion Select an answer first