4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company's SIEM generates an alert for a failed login, and a separate alert for a successful login from a different country 30 minutes later. The security team wants to determine if these events are related and part of a single attack. What is the most effective method to achieve this?

   • ADisable the account that had the successful login
   • BManually review the raw logs from both events to look for common attributes like source IP or username
   • CIncrease the alert severity for all failed login attempts
   • DCreate a correlation rule in the SIEM that links events with the same username and source IP within a defined time window
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is a correlation rule in a SIEM?

   • AA set of conditions that define when events are related
   • BA rule that blocks all traffic
   • CA rule that deletes logs
   • DA rule that encrypts data
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   How should alerts be prioritized?

   • ABased on potential impact and likelihood
   • BBased on the number of alerts
   • CBased on the order they are received
   • DBased on the source IP address
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is a key characteristic of anomaly detection techniques?

   • AThey rely on known attack signatures
   • BThey are only effective against known malware
   • CThey identify deviations from established baselines
   • DThey require no baseline data
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A software development team is designing a new customer-facing web application that handles payment information. They want to identify potential threats by examining the system's components and how an attacker might exploit the data flow between the web server and the database. Which threat modeling methodology is most suitable for this analysis?

   • AKill chain analysis, to map the stages of a potential attack from reconnaissance to exfiltration
   • BDREAD, to assign a numerical risk rating to each identified threat
   • CSTRIDE, to systematically categorize threats like Spoofing, Tampering, and Information Disclosure for each component and data flow
   • DAttack trees, to model the attacker's goals and the various paths to achieve them
   Reveal Solution Discussion Select an answer first