01
True or false
1 point
True or false: A practical threat-analysis lifecycle is iterative, and feedback from actions can guide the next analysis.
Free Practice Quiz Question List
1 Foundations of Threat Analysis Online Quiz Questions
Use this free practice quiz with 20 questions to review 1 Foundations of Threat Analysis, test your knowledge, and prepare for your next test or exam.
20 questions
02
Fill in the blank
1 point
An individual or group that poses a threat is a .
03
Fill in the blank
1 point
A weakness in a system, its implementation, or its security procedures that could be exploited is a .
04
Choose one
1 point
An analyst has gathered login logs and alerts. They correlate the records, check how current they are, and separate confirmed observations from assumptions. Which lifecycle stage are they performing?
- A
Collect information
- B
Process and validate
- C
Analyze and assess
- D
Communicate and act
05
Choose one
1 point
An adversary seeks initial access to an organization and sends phishing messages to pursue that goal. Which option correctly identifies the goal and the method?
- A
The goal is a technique, and phishing is a tactic.
- B
The goal is a tactic, and phishing is a technique.
- C
The goal is a procedure, and phishing is an attack.
- D
The goal is a vulnerability, and phishing is an indicator of compromise.
06
Choose one
1 point
An actor uses a tailored email sent to a named employee, with a particular link and timing, to carry out a general method of phishing. What is this specific implementation called?
- A
A tactic
- B
A technique
- C
A procedure
- D
A vulnerability
07
True or false
1 point
True or false: Mapping observed behavior to MITRE ATT&CK is, by itself, proof that a particular actor carried out an incident.
- A
True
- B
False
08
Written response
1 point
What term describes an attempt to gain unauthorized access or compromise confidentiality, integrity, or availability?
09
Choose all
1 point
Which items are included in cyber threat information as described in the material? Select all that apply.
- A
Indicators
- B
Adversary behavior
- C
Asset inventories
- D
Vulnerabilities
- E
Suggested defensive actions
10
Choose all
1 point
An assessment identifies relevant organizational exposure. Which defensive actions could help reduce risk or improve readiness? Select all that apply.
- A
Patch or otherwise mitigate relevant vulnerabilities
- B
Strengthen authentication
- C
Limit privileges
- D
Monitor for suspicious behavior
- E
Treat every threat report as proof of an active attack
11
Choose one
1 point
An analyst has correlated evidence but cannot confidently identify who is responsible. Which communication would best support an informed decision?
- A
A definite actor identity inferred from any ATT&CK mapping
- B
A list of raw indicators without interpretation
- C
An assessment that explains confidence and potential impact
- D
A conclusion that any threat report means a patch is urgent
12
Open ended
1 point
A monitoring system reports a match for a suspicious URL, but the analyst has not yet found related evidence. Explain how the analyst should assess and communicate this finding before concluding that an incident occurred.
13
Choose one
1 point
A server has an unpatched software flaw, and an intruder attempts to exploit it to copy records. Which option correctly distinguishes the flaw from the intruder's action?
- A
The unpatched flaw is the attack, and the attempt to access the server is the vulnerability.
- B
The unpatched flaw is the vulnerability, and the attempt to access the server is the attack.
- C
Both the flaw and the attempt are indicators of compromise.
- D
The flaw is the procedure, and the attempt is the threat actor.
14
Choose one
1 point
A security team is asked to assess whether a public-facing service needs urgent attention. What should it do first in a threat-analysis lifecycle?
- A
Collect every available log and threat report before deciding what to investigate.
- B
Define the decision to support and the scope of the investigation.
- C
Select a mitigation before assessing the organization’s exposure.
- D
Map the incident to an adversary group before gathering evidence.
15
True or false
1 point
A threat actor must be an external group whose identity and motive are known.
- A
True
- B
False
16
Choose one
1 point
An adversary uses phishing as a general method, then sends a tailored email with a particular link to a named employee at a planned time. Which term best describes the tailored email and its timing?
- A
Tactic
- B
Technique
- C
Procedure
- D
Vulnerability
17
Written response
1 point
What core-concept term describes an attempt to gain unauthorized access or compromise confidentiality, integrity, or availability?
18
Choose one
1 point
An internet-facing application has an unpatched software flaw that could allow unauthorized access. What does the flaw itself represent?
- A
Vulnerability
- B
Attack
- C
Indicator of compromise
- D
Threat actor
19
Written response
1 point
After taking a defensive action, a team checks whether it worked, records new findings, and uses the feedback to guide further analysis. What lifecycle stage is this?
20
Written response
1 point
An analyst is investigating suspicious logins and needs records showing account activity over time. Which internal evidence type listed in the material is most directly useful? Enter the plural name of the evidence type.