Identify and Assess Cybersecurity Threats Flashcards

A company's threat intelligence team identifies that their industry sector is being actively targeted by a nation-state group. What type of threat intelligence is this?

Answer: Strategic intelligence

Strategic intelligence provides high-level information about threat actors, their motivations, and targeting trends to inform executive decision-making and long-term planning.

Which attack technique involves an adversary intercepting communications between two parties without either party being aware?

Answer: Man-in-the-Middle (MitM) attack

A Man-in-the-Middle attack allows an adversary to secretly intercept and potentially alter communications between two parties who believe they are communicating directly.

In the context of the Diamond Model of Intrusion Analysis, which four elements are used to describe a cyber intrusion?

Answer: Adversary, Capability, Infrastructure, Victim

The Diamond Model characterizes intrusions using four core elements: Adversary (who), Capability (how), Infrastructure (where), and Victim (target).

What is the primary goal of a Business Email Compromise (BEC) attack?

Answer: Manipulating employees into fraudulent wire transfers or credential disclosure

BEC attacks use social engineering via spoofed or compromised executive email accounts to trick employees into transferring funds or revealing sensitive information.

An analyst discovers that an attacker used a legitimate administrative tool already present on the system to move laterally. This technique is known as:

Answer: Living off the land (LotL)

Living off the land (LotL) techniques use legitimate built-in tools like PowerShell or WMI to conduct attacks, making detection harder since no foreign binaries are introduced.

Which threat assessment methodology assigns numeric scores to threats based on damage potential, reproducibility, exploitability, affected users, and discoverability?

Answer: DREAD

DREAD is a risk-scoring model where each letter represents a rating category: Damage, Reproducibility, Exploitability, Affected users, and Discoverability.

A threat actor registers domain names that are slight misspellings of legitimate company domains to trick users. This is called:

Answer: Typosquatting

Typosquatting involves registering misspelled versions of legitimate domains to capture traffic from users who make typing errors and redirect them to malicious sites.