Perform Threat Modeling CSSLP Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A threat intelligence analyst is reviewing feeds from multiple sources. One source reports a new strain of ransomware targeting a specific industry. Another source reports a general increase in phishing campaigns. A third source reports a zero-day vulnerability in a widely used VPN appliance. The analyst must decide which intelligence to prioritize for the organization's threat model. The organization uses the affected VPN appliance for remote access. Which piece of intelligence should be prioritized?

   • AAll three equally, because all threat intelligence is equally important.
   • BThe ransomware strain, because ransomware is generally more damaging than a VPN vulnerability.
   • CThe phishing campaign, because phishing is the most common initial attack vector.
   • DThe zero-day vulnerability in the VPN appliance, because it directly affects a component the organization relies on and is likely to be exploited.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a component of the CVSS base metrics?

   • AAttack tree depth
   • BThreat category
   • CAttack vector
   • DBusiness impact
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A user reports that their files have been encrypted and a ransom note is displayed demanding payment in cryptocurrency to restore access. The user's machine shows no signs of self-propagation to other systems on the network. Which type of malware is most likely responsible?

   • ATrojan
   • BVirus
   • CWorm
   • DRansomware
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a supply chain attack in the context of third-party supplier risks?

   • AAn attack that uses social engineering to trick employees into revealing credentials
   • BAn attack that targets a company's logistics and shipping operations
   • CAn attack that compromises a supplier's software or hardware to infiltrate the customer's systems
   • DAn attack that targets a company's physical supply chain to disrupt production
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A software company uses a third-party library for authentication in its flagship product. A critical vulnerability is disclosed in this library, and the vendor has released a patch. However, the company's release process is slow, and applying the patch would require a full regression test cycle that would delay a major feature release by two weeks. The company's leadership is pressuring the team to ship the feature on time. What is the most appropriate risk management decision?

   • AReplace the third-party library with a custom-built authentication module in the same release.
   • BShip the feature on time and apply the patch in the next release cycle, since the vulnerability is not yet exploited.
   • CApply the patch immediately and delay the feature release, prioritizing the security of the product and its users.
   • DShip the feature on time but add a note in the release documentation about the known vulnerability.
   Reveal Solution Discussion Select an answer first