Integrate Intelligence-Informed Advanced Adversary Emulation and Threat Modeling. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of integrating threat intelligence into adversary emulation?

   • ARunning a vulnerability scan on all servers
   • BReviewing system logs for errors
   • CUsing a known threat actor's TTPs to design the emulation scenario
   • DConfiguring a firewall to block all inbound traffic
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security architect is planning an adversary emulation exercise for a large enterprise. The exercise will simulate a sophisticated threat actor. The architect needs to define the scope and rules of engagement. The enterprise has multiple business units with different risk tolerances. Some business units are willing to accept more risk to test their defenses, while others are not. What is the most appropriate way to define the scope?

   • AExclude business units with low risk tolerance from the scope.
   • BWork with each business unit to define the scope and rules of engagement based on their risk tolerance.
   • CInclude all business units in the scope to ensure comprehensive testing.
   • DUse a single set of rules of engagement for all business units to ensure consistency.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security architect is conducting a threat model for a new payment processing system. The system handles sensitive customer data and is subject to regulatory compliance. The architect has identified several threats and needs to prioritize them for remediation. The organization has limited resources and wants to focus on the most critical threats. The architect has access to threat intelligence that indicates a specific threat group is targeting similar systems. Which approach should the architect take to prioritize the threats?

   • AUse PASTA to conduct a full risk assessment and prioritize based on the risk score.
   • BUse DREAD to rate each threat and prioritize based on the highest scores.
   • CUse STRIDE to categorize the threats and then prioritize based on the categories that are most relevant to the threat group.
   • DUse MITRE ATT&CK to map the threat group's techniques to the system's potential threats and prioritize based on the techniques that are most likely to be used.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team is planning an adversary emulation exercise. They have access to a threat intelligence platform that provides real-time feeds of IOCs and TTPs. The team wants to ensure the exercise is based on the most current threat landscape. How should they integrate the intelligence into the emulation plan?

   • AShare the intelligence feed with all security analysts and ask them to incorporate it into their daily monitoring.
   • BWait until the intelligence feed is stable and then use the IOCs to create detection rules.
   • CUse the IOCs to block known malicious domains and IPs in the firewall before the exercise.
   • DIncorporate the TTPs from the intelligence feed into the emulation steps, and use the IOCs to validate the exercise.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of using a structured threat modeling framework like STRIDE or DREAD?

   • ATo automatically patch vulnerabilities in software
   • BTo systematically identify and prioritize potential threats to an organization's assets
   • CTo provide a list of all known malware signatures
   • DTo replace the need for security monitoring
   Reveal Solution Discussion Select an answer first