01
True or false
1 point
True or false: One unusual sign-in is enough to prove who is responsible for a cyber incident.
Free Practice Quiz Question List
7 Threat Analysis Practice Online Quiz Questions
Use this free practice quiz with 20 questions to review 7 Threat Analysis Practice, test your knowledge, and prepare for your next test or exam.
20 questions
02
Choose one
1 point
In the changed payroll account case, what is the best conclusion from the unexpected MFA approval, unfamiliar sign-in, and new forwarding rule?
- A
The employee’s account is confirmed to have been taken over by a particular criminal group.
- B
The combined signs support an account-compromise hypothesis, but the actor is not identified.
- C
The forwarding rule proves that payment details have already been changed.
- D
The unfamiliar sign-in is a vulnerability rather than an indicator.
03
Written response
1 point
An internet-facing appliance runs outdated software with a known flaw. What term describes the weakness that could be exploited?
04
Fill in the blank
1 point
Complete the distinctions: Evidence that an incident may have occurred or may be underway is an . A weakness that could be exploited is a .
05
Choose one
1 point
An exposed remote-access appliance has a known flaw, suspicious requests, a new administrator account, and an unfamiliar external connection. What priority does the recommended analysis assign while the case is investigated?
- A
Low, because an outdated version alone cannot be exploited.
- B
Moderate, because the external connection proves the incident is contained.
- C
Critical, because the exposed appliance may be compromised and could provide access to internal systems.
- D
High, because the evidence identifies a targeted attacker.
06
Choose all
1 point
For the changed payroll account case, select all actions that are appropriate to reduce immediate risk while supporting the investigation.
- A
Contact the employee through a trusted channel and secure the account, including revoking active sessions and tokens.
- B
Delete relevant logs and messages immediately so the attacker cannot access them.
- C
Pause and independently verify any payment changes.
- D
Remove unauthorized mailbox rules and review recent account activity.
07
True or false
1 point
True or false: MITRE ATT&CK can help structure an investigation, but using it does not by itself prove who carried out an attack.
- A
True
- B
False
08
Written response
1 point
Several servers begin contacting unfamiliar domains after a routine software update. What compromise hypothesis does this timing raise, without proving it?
09
Fill in the blank
1 point
During investigation of the exposed remote-access appliance, preserve its before applying a fix or replacing it.
10
Choose all
1 point
In the vendor-update case, select all reported signs that indicate possible expansion or impact, rather than proving a specific cause.
- A
Several servers contact unfamiliar domains.
- B
Endpoint protection stops reporting from two servers.
- C
A routine update occurred, which by itself proves a supply-chain compromise.
- D
A backup repository is no longer accessible.
- E
The service account runs the updated software across multiple systems.
11
Choose one
1 point
When prioritizing an incident with incomplete evidence, which approach best reflects the recommended risk analysis?
- A
Rank the incident only by the number of alerts generated.
- B
Assign a severity score based only on whether a vulnerability exists.
- C
Assess likelihood and impact in light of exposure, exploitation evidence, criticality, scope, and safeguards.
- D
Wait for confirmed actor attribution before deciding priority.
12
Open ended
1 point
A payroll employee approved an unexpected MFA prompt, signed in from an unfamiliar location, and then received a new inbox-forwarding rule. A request to change a supplier’s payment details followed. Recommend an ordered response and explain why the incident’s priority is appropriate.
13
True or false
1 point
True or false: Unfamiliar network activity beginning after a software update proves that the update was malicious.
- A
True
- B
False
14
Choose one
1 point
After investigating a potentially compromised vendor update, which pair of improvements is recommended to reduce similar future risk?
- A
Rely on routine updates without an approval process so that changes are deployed faster.
- B
Improve vendor notification requirements and software approval.
- C
Disable protected logging to prevent software vendors from receiving information.
- D
Treat vendor notification as a substitute for incident-response procedures.
15
Written response
1 point
An internet-facing appliance runs outdated software with a known flaw. What term describes the flaw itself, rather than evidence that someone exploited it?
16
Choose one
1 point
In the payroll case, sign-in logs show unfamiliar access and a new inbox-forwarding rule appears. Which statement is an observed fact rather than an inference?
- A
The employee’s account was taken over.
- B
A new inbox-forwarding rule appeared.
- C
A financially motivated criminal made the change.
- D
The payment request will cause a financial loss.
17
Choose one
1 point
An analyst wants to organize observed actions into an attack chain without claiming that a particular group carried them out. How can MITRE ATT&CK help?
- A
It proves which group carried out an incident.
- B
It establishes that every listed technique occurred in the case.
- C
It helps organize observed adversary actions by goals and techniques.
- D
It assigns a definitive risk level to each incident.
18
Written response
1 point
In the payroll case, what kind of channel should the response team use to contact the employee about the unexpected authentication prompt?
19
Choose one
1 point
An exposed remote-access appliance has a known flaw, suspicious requests, a new administrator account, and a subsequent connection to an unfamiliar address. What priority should responders assign while investigating?
- A
Low, because the logs do not yet identify an attacker.
- B
Critical until investigated, because the exposed appliance may provide access to internal systems.
- C
Moderate, because a new account alone cannot prove exploitation.
- D
High only if the unfamiliar external address is confirmed to be malicious.
20
Choose one
1 point
Several servers contact unfamiliar domains after a routine software update, endpoint protection stops reporting from two servers, and a backup repository becomes inaccessible. Which conclusion is best supported?
- A
The update proves that the vendor intentionally compromised the systems.
- B
A supply-chain compromise is plausible, but a faulty update, configuration change, or separate intrusion could also explain the signs.
- C
The unfamiliar domains prove that the update was authentic and safe.
- D
The inaccessible backup repository establishes which actor caused the incident.