Threat Analysis & Vulnerability Management Flashcards

Which CVSS v3 metric indicates whether a vulnerability can be exploited without any authentication?

Answer: Privileges Required: None

The Privileges Required metric set to None means the attacker requires no authentication to exploit the vulnerability.

In threat intelligence, what does the term 'TTP' stand for?

Answer: Tactics, Techniques, and Procedures

TTPs describe how threat actors operate, covering their Tactics (goals), Techniques (methods), and Procedures (specific implementations).

A security team discovers a publicly disclosed vulnerability with no vendor patch available. This is best described as a:

Answer: Zero-day vulnerability

A zero-day is a vulnerability that is publicly known (or actively exploited) but has no official vendor patch available.

Which threat modeling methodology uses the acronym STRIDE to categorize threats?

Answer: Microsoft Threat Modeling

Microsoft's Threat Modeling methodology introduced STRIDE, which categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

What is the primary purpose of a vulnerability scanner in an NSE environment?

Answer: Identify and report known weaknesses in systems and applications

Vulnerability scanners enumerate hosts and compare their configurations and software versions against known vulnerability databases to report weaknesses.

An analyst receives an IOC feed containing file hashes. Which attack phase do file hash indicators most directly relate to?

Answer: Delivery and execution

File hashes are used to identify malicious files delivered to a target, directly mapping to the delivery and execution phase of the kill chain.

FortiGuard's threat intelligence service provides which type of data to FortiGate firewalls?

Answer: Malicious IP/domain reputation, IPS signatures, and antivirus updates

FortiGuard delivers continuously updated threat intelligence including IP/domain reputation, IPS signatures, antivirus definitions, and web filtering categories to FortiGate devices.