A criminal crew is known to send password-reset lures to a bank's staff, and no such lure has arrived today. What is that crew in this description?
Select an answer to reveal the explanation.
Short Explanation
A known burglar is still a threat on a day they have not walked up your street. You classify the crew that sends these lures as a threat. The trap is turning the crew into a mail-gateway flaw, an exploit kit, or a dashboard number.
Full Explanation
A threat is the actor or event that may cause harm. This sentence names a crew and the lures that crew is known to send. No message today does not erase the crew. A weakness in the mail gateway, a software kit, and a residual-risk figure are not the crew. "A threat: the crew known to send password-reset lures to this bank's staff". The crew is the actor in the sentence, so the crew is the threat even though today's inbox is quiet. "A vulnerability in the bank mail gateway that the crew would need before any lure could be sent". A vulnerability would be a weakness in the mail gateway. The sentence describes people who send lures, not a flaw in the gateway product. "An exploit kit that packages code for abusing a flaw in the bank mail gateway". An exploit kit is packaged code that abuses a flaw. The stem does not describe tooling; it describes the crew. "The residual risk number for phishing as shown on the bank risk dashboard today". A residual risk number is a rated figure on a dashboard. The crew is not that number, and the stem does not give one. Exam caveat: a threat can be identified before today's lure arrives. Quiet mail does not reclassify the crew as a vulnerability. Operational check: read the intel note for the crew and the lure type, then check whether any such message actually arrived at the bank today.