4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which step in the threat modeling process involves determining the likelihood and impact of identified threats?

   • AMitigation planning
   • BAsset identification
   • CThreat enumeration
   • DRisk assessment
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is investigating an incident where an attacker gained access to a system, escalated privileges, and then moved laterally to other servers. The analyst wants to map the attacker's techniques to a standardized framework to identify gaps in detection coverage. Which framework is most appropriate for this analysis?

   • ASTRIDE, to identify the type of threat (e.g., spoofing, tampering)
   • BISO 27001, to assess compliance with security standards
   • CDREAD, to calculate the risk score of the incident
   • DMITRE ATT&CK, to map the specific tactics and techniques used by the attacker
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security architect is leading a threat modeling exercise for a new remote access solution. The team has identified the VPN gateway, authentication server, and employee laptops as key assets. They have also enumerated potential threats, including credential theft and man-in-the-middle attacks. What is the next step in the threat modeling process?

   • AClassify each threat using the MITRE ATT&CK framework
   • BImmediately implement security controls to mitigate the identified threats
   • CAssess the likelihood and impact of each identified threat to determine the risk and prioritize mitigation efforts
   • DDocument the system architecture and data flow diagrams
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of analyzing a detected anomaly?

   • ATo determine if it indicates a potential security concern
   • BTo immediately block all related traffic
   • CTo delete the anomaly logs
   • DTo update the baseline automatically
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which activity is part of anomaly investigation?

   • AChanging all user passwords
   • BIgnoring the anomaly if it occurs once
   • CImmediately escalating all anomalies to law enforcement
   • DCorrelating the anomaly with other events
   Reveal Solution Discussion Select an answer first