Cyber Threat Intelligence Analyst (CTIA) Practice Exam

These questions are part of the practice quiz. Start practicing

• In threat sharing, which trust model uses evidence from one organization to establish trust with a second organization, with trust depending on evidence quality?
• A senior manager has forwarded several email warnings about cyber threats; what is the first thing the threat intelligence team should do before acting?
• Which term best describes the process of turning unknown threats into known threats?
• Geopolitical assessments provide which type of threat intelligence data?
• During threat modeling, which stage involves threat actor profiling and attribution to inform countermeasures?
• Which type of honeypot offers the most realistic interaction with attackers but carries the highest risk of compromise?
• Which CTI phase is associated with aligning intelligence work with organizational values and priorities?
• Which phase of an advanced persistent threat lifecycle is characterized by expanding access within the network after initial intrusion?
• Which of the following is an example of a Priority Intelligence Requirement (PIR) for an organization?
• Which outcome is most closely associated with gap analysis in threat intelligence program evaluation?
• Which of the following cognitive biases can adversely impact how an analyst applies personal beliefs about theories to the threat analysis process?
• Which option best describes the purpose of a threat repository?
• What is the role of threat intelligence in risk management?
• Which Google search operator restricts results to URLs containing a specific string?
• Which type of threat intelligence analysis focuses on actionable, short-term indicators such as modus operandi, tools, and communication channels?
• Which type of honeypot is least interactive, typically providing minimal interaction with attackers?
• Which category of threat information contains advisories?
• Which type of intelligence is collected from sources like Honeypots, Passive DNS monitors, online web trackers, or Sock puppets?
• What is the relationship between CTI and risks?
• OSINT can be obtained from which sources?
• In bulk data collection, which form involves collecting large amounts of data from multiple sources in multiple formats and then processing to achieve threat intelligence?
• Which type of attacks are more likely to be quiet, using stealth over extended periods?
• Which of the following is not considered an emerging threat landscape area?
• Which report section will contain details of how the intelligence was processed?
• To collect strategic threat intelligence about current cybersecurity posture and potential financial impact, which sources are most appropriate?
• Which type of security testing uses scenarios to mimic attackers?
• What is a gateway?
• What mechanisms can be used by APTs to exfiltrate data while evading data loss prevention technologies?
• Which type of data analysis focuses on past events?
• Which term best describes the level of threat intelligence used to understand near-term threats?
• To disseminate intelligence effectively, which criterion addresses making the intelligence concise and balanced in presentation across tables, narrative, numbers, graphics, and multimedia?
• Which option is typically the most cost-effective way to integrate threat intelligence into existing network defenses for a small organization?
• In cognitive-based threat analysis, the initial step is to
• In the advanced persistent threat lifecycle, which phase involves expanding access after gaining initial foothold?
• Which component of the threat triad best represents an attacker’s ability and resources to perform an attack?
• In which storage architecture is the data stored locally on a system or storage hardware and capable of storing a limited amount of data?
• Why are Indicators of Compromise important to an organization's cyber threat intelligenc program?
• Which of the following are NOT usually characteristic of APTs?
• In incident response, integrating threat intelligence into the process helps provide context to alerts in which phase?
• If a security team wants to supplement internal intelligence with third-party insights, which category are they leveraging?
• Which type of data analysis creates a logical sequence of events based on assumptions about an adversary?
• Which of the following goals is met by the Traffic Light Protocol?
• To protect sensitive data contained in a published threat indicator, which measures should be used?
• Threat intelligence sharing platforms are essential primarily to enable rapid sharing of threat intelligence between critical infrastructure entities.
• Which criterion is used to rate intelligence delivered to stakeholders to improve defense strategies and reduce recurring threats?
• Which approach helps ensure analysts do not spend excessive time gathering data?
• Which option BEST explains the rationale for collecting intelligence at conferences when that intelligence cannot be obtained through Internet sources?
• A non-disclosure agreement (NDA) is a contract used between companies or between a company and individual(s) to identify information that must be protected and to inform recipients of their obligations to protect that information from disclosure. Why are NDA's an important tool for threat intelligence sharing?
• Which phase of the APT lifecycle involves expanding access to additional systems after initial compromise?
• In policy monitoring, which statement is true?
• Threat data feeds are most useful at which level of threat intelligence activities?
• What indicator of compromise best fits a scenario with multiple logins from different locations in a short period and irregular patterns from distant locations?
• Among the following cyber security threats, identify the one that falls under Host threat category.
• Which advanced threat analysis technique can be used to fine-tune and enhance the analysis process?
• A CISO consumes threat intelligence to understand business trends and inform decisions on budgets, technology, and staff. Identify the type of threat intelligence consumer.
• How does intelligence-led security testing differ from normal methods of security testing for IT systems?
• To convince management and justify starting a threat intelligence program, which features should be emphasized?
• Which statement describes the Planning and Direction phase in CTI?
• Which maturity level indicates a CTI program is actually in place?
• Which primary use case relies upon information from previous attacks against an organization?
• Which types of employee information can be gathered from online groups, forums, and blogs?
• What is the main purpose of CTI?
• In the context of the Cyber Kill Chain, what is meant by "weaponization"?
• What is the correct sequence of steps involved in scheduling a threat intelligence program?
• Which attack involves sending an oversized IP packet to cause a buffer overflow and crash the target?
• How is policy compliance monitored?
• If leadership seeks guidance on long-term cybersecurity strategy in a threat intelligence context, which report type would be most relevant?
• Which step most directly determines whether the prioritized threat list aligns with organizational objectives?
• What is the first stage or phase of the Threat Intelligence Lifecycle?
• What mistake did Sam make when using data from a low-cost open-source threat data provider without verification?
• Why are intended audience and stakeholders important for evaluation of threat intelligence?
• Which of the following is a typical indicator of compromise?
• An analyst is investigating DNS poisoning attacks. Which DNS record types could have been used to change a DNS server to direct traffic to the attacker's servers?
• Which remedies for logical fallacies can be used to ensure that analysts do not spend too much time on data collection?
• Root cause scenario with university lab web server used to spread malware through the campus network?
• Which data analysis technique is described as the standard process analysts use to efficiently narrow down information from collected data and is applicable to any data type?
• Which data category is typically used to inform long-term planning and strategic context in threat intelligence?
• Threat intelligence data collection that includes IP addresses, operating systems, and malware behavior is best described as which type?
• In the context of advanced persistent threats, which phase involves moving from one compromised system to broader network access?
• Why does a business need to audit information being sent over its networks?
• Thomas wants bulk data integration and data management in coordination with Hadoop. Which of the following tools should Thomas use?
• Which DNS technique uses a single domain resolving to multiple IP addresses to hide infrastructure?
• What is actionable intelligence?
• Which statement about metadata in web pages is true?
• Tyrion wants to view header content for footprinting: Connection status and content type, Accept-ranges and last-modified information, X-powered-by information, Web server in use and its version. Which tool should Tyrion use?
• What is the primary purpose of attack chain mapping in threat intelligence?
• The goal of most APT attacks is to
• An analyst used publicly available sources and analyzed to obtain intelligence. This source is primarily used for national security, law enforcement, and for business or strategic decision making. Which source of intelligence did the analyst use?
• In the threat intelligence maturity model, which level corresponds to having a CTI program in place?
• In a competing hypotheses exercise, which stage focuses on organizing hypotheses and the evidence into a matrix to refine conclusions?
• Why is strategic threat intelligence generally not shared externally?
• IoCs are used to build what kind of threat intelligence?
• Which statement about threat intelligence feeds is true?
• Which security control is a centralized system to collect, analyze, and alert on security events?
• Which maturity level represents the most mature stage with formalized governance and well-defined processes?
• HUMINT is collected from which of the following sources?
• A network administrator collects log files from a traffic monitoring system, which initially may seem unhelpful but after analysis can reveal an attack. What category of threat information has he collected?
• Which step in CTI involves prioritizing your objectives in adherence to your organization's core values?
• Which analytic process is designed to discard hypotheses that are not supported by the data?
• In the APT lifecycle, after gaining access to a single system, expanding access inside the network corresponds to which phase?
• Choose the network that supports mobile communications across arbitrary wireless LANs and satellite coverage areas.
• Impersonation to collect information about an organization is an example of which technique?
• What step should be taken to finalize a prioritized list of threats?
• Which type of escalation will result in the best course of action for responding to threat-based intelligence without involving higher levels of management?
• In threat intelligence sharing models, which tier concentrates on a small number of communities such as critical infrastructure sectors and has tailored sharing requirements?
• Which activity describes assessing a TI program’s success by comparing deliverables to the original objectives and identifying gaps?
• Which combination best describes domain reputation assessment?
• What is the primary goal of an Advanced Persistent Threat?
• Which statement best reflects a CTI program in place within an organization?
• Which project management artifact outlines the purpose, objectives, and stakeholders for an initiative and helps secure executive sponsorship?
• Which CTI phase is primarily responsible for setting priorities and directing intelligence work?
• Which Microsoft Office application is suitable for statistical analysis of threat data?
• Cyber Threat Intelligence can help identify which of the following
• A threat intelligence analyst reviews the project charter and deliverables to assess TI program success. Identify the activity being performed.
• What is the primary purpose of a non-disclosure agreement in threat intelligence sharing?
• Which statement about the Trust Boundary in system modeling is correct?
• Which sharing platform should Kim use to gather and share threat information to develop security policies?
• A _____ is a guideline that describes how an attack is performed.
• The Cyber Kill Chain Methodology benefits threat analysts by which of the following?
• Which of the following types of threat attribution deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its target?
• Patch management is an essential task for managing which of the following components?
• How can Cyber Threat Intelligence be used to combat data loss?
• Which maturity level is defined as Level 1: preparing for CTI?
• Which policy monitoring practice is commonly involved?
• Which approach aligns threat intelligence activities with business needs?
• Operational threat intelligence can be sourced from which of the following?
• A hacker establishes a two-way communication channel with a victim system, uses encryption to hide the channel, and escalates privileges to exploit. Which phase of the cyber kill chain is this?
• In the Cyber Kill Chain, what is the primary objective of the Delivery phase?
• Which indicator of compromise would indicate misuse of a privileged account?
• What does ADA stand for in threat analysis?
• Which act enables sharing of cybersecurity information between the private sector and the federal government?
• Which of the following is a non-physical asset?
• Which component refers to a node in the network that routes the traffic from a workstation to external command and control server and helps in identification of installed malware in the network?
• Which artifact defines the scope and deliverables of a project for threat intelligence?
• An intelligence consumer has asked for threat reporting that can be fed directly into its firewalls, SIEM systems, and endpoint protection systems. What type of report format is needed?
• In traffic light protocol (TLP), which color indicates that information should be shared only within a specific community?
• CISCO Cognitive Threat Analytics support which of the following?
• In the Threat Intelligence Lifecycle, which stage is primarily responsible for disseminating finished intelligence to stakeholders?
• Which capability in a threat knowledge repository helps ensure data remains relevant by enabling archival or deletion of outdated entries?
• Miley used filtering, tagging, and queuing to sort relevant data from large amounts of unstructured data. Which technique was employed?
• Which of the following are examples of unstructured data?
• Which type of threat attribution deals with identifying the specific sponsor behind a well-planned intrusion?
• What type of threat intelligence was shared when a threat actor TTPs, malware campaigns, and tools used were provided to security operations?
• In threat information sharing, what primarily determines the level of trust between two organizations in the specified trust model?
• Which type of threat attribution attempts to identify the specific actor behind a well-planned intrusion?
• Where could a nation-state with few resources learn the basic tools and techniques used by hackers?
• Which of the following has no purpose other than to entrap an attacker and collect information about the origins of the attack?
• Which threat intelligence category translates strategic goals into actionable threat indicators for security teams?
• Which is a vertical community source where information is collected from various threat intelligence sharing communities?
• A threat knowledge base can be stored in a ________.
• Threat modeling results in what type of representation?
• Which three elements are cited as drivers, obstacles, and benefits in justifying a threat intelligence program to management?
• ISAO/ISACs are primarily established to facilitate information sharing within which scope?
• Which of the following is a seven-stage risk-based modeling approach implemented for dynamic threat detection, enumeration, and scoring process?
• A/an _____ is a potential occurrence of a/an ___ event which can eventually cause harm or loss.
• Before launching a threat intelligence program, what preliminary activity is recommended to ensure readiness?
• Which statement best describes tools used to collect information about an Internet domain?
• Which of the following teams can benefit from having access to Cyber Threat Intelligence?
• Which of the following is a malware analysis tool that uses hash values to identify and track data across a network?
• In the scheduling sequence, which step logically follows 'Identify all deliverables'?
• Which of the following best describes the process of data mining?
• An attacker wants to obtain information to use in a whaling attack. Which source provides executive information most suitable for a whaling attack?
• A threat intelligence feed primarily consists of what?
• Which outcome is expected when correlating threat intelligence reports from multiple sources?
• Why is intelligence-led security testing important?
• Alison wants to retrieve information about a company's website from its inception and removed information from the target website. What should she use to get the information she needs?
• In the context of Indicators of Compromise, what is the difference between atomic indicators and computed indicators?
• Which of the following is an MS Office application that can be used to perform statistical analysis for threat data?
• Select the standard protocol used for interfacing external application software with a web server.
• Which type of threat intelligence analysis is most likely to use information from chat room conversations?
• What is the earliest step recommended when starting to build a threat intelligence program?
• Which metric would be most appropriate to describe the spread of data in a dataset?
• Which type of information is typically obtained by inspecting online job sites for a threat intelligence program?
• What is the primary purpose of the Intelligence and Collection Planning process?
• In what way can evaluated threat intelligence support management decisions?
• In a tiered information sharing model, which factor is commonly required for Tier 3 exchanges?
• Which modification helps the analyst identify and remove noise from the data set?
• Which role typically takes the forensic backups of systems that are the focus of an incident within an incident response team?
• Why should analysts perform continuous monitoring of Indicators of Compromise?
• Who invented the Cyber Kill Chain Methodology?
• In budgeting a threat intelligence program, which concept defines potential funding constraints that the organization must respect?
• From a strategic perspective, which statement best describes the role of threat intelligence in an organization?
• Which characteristic of a Threat Intelligence Solution assists in the management of SIEM capabilities?
• Which data-processing technique is used to scale data values to a common range for comparison?
• What term describes the risk management process where an analyst analyzes operations from an adversary’s perspective to inform security measures?
• Which of the following statements best describes data validation techniques used in threat intelligence analysis?
• Which of the following factors can be used to convince management to fund a threat intelligence program?
• Why should help desk personnel be included on distribution lists for threat intelligence reports?
• Which type of threat actors are unskilled hackers who compromise systems by using scripts and tools developed by more skilled attackers?
• What term describes consistent attacker behaviors, techniques, and procedures used across campaigns?
• When establishing a business case, what is a "driver"?
• In the scenario where an attacker sends illegitimate emails with malicious links to harvest sensitive information, what type of attack is described?
• Which pivot method would be used to obtain information about an adversary's infrastructure when the analyst does not know what to look for?
• The first stage or phase of the Threat Intelligence Lifecycle involves establishing objectives and directing collection. Which option best describes this stage?
• Which DNS records could be involved in redirecting DNS to attacker servers?
• Which of the following can help deduce adversaries' TTPs?
• Why is the preparation phase imperative for the success of an APT attack?
• What is data staging in the context of cyber attacks?
• Which type of intelligence feed is most likely to provide a threat intelligence team with real-time or near real-time information about threats to an organization's reputation?
• Which agreement is commonly used to protect confidential information during a threat intelligence program?
• What is the strongest reason an organization would likely not share threat reports compiled by its analysts?
• Relying on low-cost open-source threat data without validation can lead to what risk?
• A threat analyst is fulfilling the needs of a Red Team. Which option best describes these needs?
• Which type of threat intelligence reports could be used to best defend the budget prioritization in a boardroom discussion?
• In which phase of the Cyber Kill Chain does an attack download additional software to take up residence on target systems?
• Which tactic is used by threat actors to collect information from human subjects?
• Which of the following is an example of Priority Intelligence Requirements (PIRs)?
• Which type uses human-sourced data from forums and chats to identify threats?
• Which term refers to determining security designation and handling requirements by reviewing indicator metadata?
• What type of attack exploits a vulnerability before patch is released?
• Which indicator type cannot be divided into smaller parts and whose meaning does not change with context?
• To discover domains related to a given organization and identify potentially fraudulent sites, which Google search operator should you use?
• In OSINT, what is the primary purpose of using automation tools?
• Which data describes a data staging example including employees and customers’ data, business tactics, financial information, and network infrastructure information?
• Which characteristic of advanced persistent threats refers to numerous attempts made by the attacker to gain entry to the target network?
• Which practice best describes implementing continuous improvement in a threat intelligence program?
• In the intelligence cycle, which stage converts raw data into structured indicators usable for decision-making?
• Which source provides executive information most suitable for a whaling attack?
• Which type of threat attribution focuses on identifying the sponsor behind a well-planned intrusion, such as a country or organization?
• Which techniques comprise qualitative data analysis in threat intelligence, such as brainstorming, interviewing, SWOT analysis, and Delphi technique?
• In threat prioritization, which approach prioritizes threats by impact and likelihood before implementing controls?
• Which Building Block category deals with the types of information exchanges used in threat intelligence sharing?
• According to the threat intelligence maturity model, which level best describes ABC's level (Level 2: increasing CTI capabilities)?
• Threat actors who aim to bring down critical infrastructure for a 'cause' and are not worried about facing jail terms.
• OSINT can be obtained from which sources?
• Which data types are commonly included in the Indicators of Compromise section?
• An attacker wants to obtain information about visitors to a target website. Which online tool could be used?
• Which OSINT source is commonly used to collect information about adversaries without direct access?
• Chat room conversations are most often analyzed in which type of threat intelligence analysis?
• Which of the following is NOT an enterprise objective for a Threat Intelligence Program?
• Which security control acts as a node in the network and routes the traffic from a workstation to external command and control server?
• Which point should be considered while preparing a nondisclosure agreement?
• Which of the following laws restricts the sharing of sensitive information about threats and indicators of compromise affecting businesses and their financial records?
• Which act authorizes cybersecurity information sharing between and among the private sector; state, local, tribal, and territorial governments; and the Federal Government?
• To detect data staging before exfiltration, which action would be most effective?
• What type of threat intelligence is being used when asked about tactics, techniques, and procedures attackers could use against a product line?
• Traffic Light Protocol Amber indicates which sharing boundary?
• Which standard provides a machine-readable encoding of observable data such as file hashes, IPs, and domain names?
• What is the MoSCoW method primarily used for?
• What is the last phase in the implementation of a threat intelligence program?
• In a threat intelligence platform, which feature ranks intelligence sources, threat actors, attacks, and assets to prioritize security resources?
• Which of the following is not part of a scope statement for a threat intelligence program?
• Which of the following Threat Intelligence Exchange Architectures uses a member-to-member exchange modality and, because of this, is less susceptible to attacks or single point of failure outages?
• What is one benefit of a security posture assessment?
• What term describes an artifact found on a network or system that indicates an intrusion attempt with high confidence?
• Why is contextualization important to intelligence analysts?
• Identify the threat modeling technique that is more suited for an application to meet the security properties of confidentiality, integrity, and availability, and involves constructing a data flow diagram based on the threat model.
• Adversary behaviors can be indicative of programming or scripting based attacks. Which indicator is most associated with scripting?
• A network administrator analyzed log files from a traffic monitoring system; after proper analysis, the data can help detect an attack. Which category of threat information has he collected?
• Which scenario best describes using tactical threat intelligence?
• Which option is the most cost-effective method for integrating threat intelligence into existing network defense solutions for a small organization?
• Which characteristic of APT refers to numerous attempts to gain entry to a target's network?
• Phase of APT Lifecycle deals with the deployment of malware and establishment of outbound connection?
• (Choose the BEST answer) Which of the following can be used to mitigate the risk of unauthorized disclosure of sensitive information in an intelligence report?
• What does PIR stand for in threat intelligence practice?
• Which item is essential to ensure the threat intelligence program aligns with business priorities?
• What is the most common format for threat intelligence reports?
• Which of the following is NOT a responsibility of an intelligence analyst?
• Which threat actor type is typically driven by political or strategic interests and may be backed by a government?
• Which static malware analysis technique involves calculating cryptographic hashes of a binary to identify its function by comparing it to known samples?
• Which statement best describes continuous monitoring of indicators of compromise?
• What term describes unprocessed information that must be transformed to derive meaningful insights?
• Which pivot concept is used when the goal is to discover unknown infrastructure by exploring broadly?
• Which step must be taken before implementing an organization's threat intelligence program?
• Which of the following can be used to gain insight into future threats and exploits?
• Which of the following is a benefit of intelligence collaboration?
• How can an organization protect its proprietary information from disclosure by third parties working in its threat intelligence program?
• An analyst has been tasked to examine computer process lists to identify use of the Command Line Interface by attackers. What specific characteristic is indicative of attackers?
• Which actions are part of domain reputation assessment?
• Which type of threat intelligence focuses on near-real-time information to support defensive actions, including attacker techniques and current campaigns?
• What is the recommended first step when staffing a threat intelligence team?
• Which statement is NOT a characteristic of threat modeling?
• In cognitive-based threat analysis, aligning data into a structured format aids which outcome?
• Which characteristic of APT refers to numerous attempts done by the attacker to gain entry to the target's network?
• What is the main purpose of the Cyber Threat Intelligence process?
• Which term refers to the existence of a weakness that can be exploited?
• Which item is a commonly used metric to assess maturity of threat intelligence capabilities?
• Which category of threat intelligence is most concerned with strategic outlooks and long-term risk?
• Which of the following is a responsibility of a threat intelligence analyst?
• Which type provides high-level information about cyber-security posture, threats, details about the financial impact of cyber activities, attack trends, and the impact of high-level business decisions?
• Which network component serves as the gateway between internal and external networks and aids in identifying installed malware?
• What does 'true attribution' refer to?
• Which approach best reduces data overload when analyzing threat data?
• Which data analysis approach involves evaluating multiple competing hypotheses to determine the most probable explanation for observed data?
• Tim needs a threat intelligence framework that automatically performs data collection, filtering, and analysis. Which framework should he choose?
• Which phase of the threat intelligence lifecycle involves converting raw data into meaningful information using advanced tools and skilled professionals?
• The value of intelligence reporting increases with which of the following? (Choose the BEST answer.)
• Which of the following types of data analysis uses nonnumeric techniques such as Delphi technique, brainstorming, and SWOT analysis?
• Intelligence is_____.
• In bulk data collection, which form involves data that is structured and ready for analysis?
• Choose the best description for 'security pressure posture'.
• In which attack does the attacker exploit vulnerabilities in a computer application before a patch is released?
• A threat knowledge base can be stored in a ________.
• Operational security for data collection ______.
• Which characteristic of an advanced persistent threat refers to attacker attempts to gain entry through multiple origination points?
• Which of the following is an OPEN threat intelligence framework (as opposed to a closed or proprietary framework)?
• In a tiered information sharing model, Tier 3 is typically characterized by which of the following requirements?
• Which consideration must be employed by Henry to prioritize intelligence requirements?
• Which of the following best describes the role of a hypothesis in threat intelligence data analysis?
• Which of the following is a direct output of threat intelligence analysis?
• A government agency has discovered that it was penetrated by an Advanced Persistent Threat. What type information was LEAST likely to have been targeted by the attackers?
• A/an ____ is a breach of a system which takes advantage of a ____.
• Which of the following factors is NOT used when prioritizing requirements for protecting an organization's assets against attacks?
• Which of the following is a business benefit of cyber threat intelligence?
• Why is metadata from web pages useful to attackers?
• Which Organizational Trust Model uses body of evidence between organizations to establish a level of trust before sharing threat intelligence?
• What requirement must be included in a threat knowledge repository to provide the ability to modify or delete past or irrelevant threat data?
• Before sharing threat intelligence internally, an analyst should _______.
• In the context of this certification, what are Rules of Engagement?
• Not a stage of Cyber Threat Intelligence?
• Which data correlation technique measures the ordinal relationship between two measured variables?
• A SOC analyst obtains required information from which type of sharing partner that provides threat data feeds?
• Which characteristic of data can be determined using Pearson's Correlation Coefficient?
• Which of the following cognitive bias describes a person's inclination to overemphasize personality-centered reasons for actions performed by others?
• Which triad is used to describe the existence of threats?
• Which type of threat intelligence is primarily concerned with long-term strategic risk and business impact?
• Which consideration must Henry employ to prioritize intelligence requirements?
• Identify the activity that involves comparing TI project results to original objectives and reviewing deliverables for quality.
• Which approach is used to detect data staging activities?
• Which term describes the rate at which data arrives for processing in bulk data analytics?
• How can analysts detect adversarial behaviors involving data staging?
• During data collection, a threat analyst uses a method with no participants and focuses on internal analysis within the organization. Identify the type of data collection.
• Which Building Block for Threat Intelligence Sharing is associated with the Rules of Engagement and Protocols?
• Which of the following can be used by an analyst to collect information about an email based attack?
• Which network component functions as a node that forwards traffic from a workstation to external command-and-control servers and aids in malware identification within the network?
• Which threat intelligence framework should he choose to perform data collection, filtering, and analysis automatically for his organization?
• Which type of intelligence reporting is most likely to be useful in convincing senior managers to support budget requests for cybersecurity upgrades?
• What term describes a decoy system designed to entrap attackers and observe their methods?
• Daniel aims to steal data such as social security numbers, PII, and credit card information, then sells it on the black market. Daniel comes under which type of threat actor?
• Which threat intelligence stage would an analyst start with when assessing risks associated with an emerging technology?
• In evaluating threat intelligence platforms, which feature is primarily used to score and prioritize intelligence sources, actors, and assets?
• To identify the most consistent theory among competing hypotheses in threat analysis, which analytic process must a threat intelligence manager use?
• Which type of data is described as data extracted by analysts from large collections?
• In the context of data analysis, which of the following statements best describes the term 'hypothesis'?
• Which triad describes organizational components often analyzed for security readiness?
• Which actions are involved in determining domain and IP address reputation?
• Which type of threat intelligence provides a long-term, strategic view of the threat landscape and implications for the organization?
• Which data analysis method uses a timeline to understand the sequence of activities?
• Which type of reporting tool should be used to prepare the intelligence data for consumption by managers and executives?
• Why should help desk personnel be included on distribution lists for threat intelligence reports?
• Which type of sharing partner provides collections of validated threat indicators along with detailed technical malware analysis?
• Kim wants an intelligence-sharing platform to gather and share threat information from a variety of sources to develop security policies. Which sharing platform should he use?
• Which practice helps ensure an intelligence program remains informed about attacker behavior?
• Which of the following is not a factor affecting data reliability?
• Sean should use which service to find the company's internal URLs?
• A company has determined that it needs to significantly improve its cybersecurity posture. Which of the following actions should it take first?
• Organizations need to leverage ___ in order to defend against threats and improve their security posture.
• Which talent acquisition strategy should be pursued first when setting up a threat intelligence team?
• Which of the following is a key step in turning raw threat intelligence data into actionable intelligence by reducing noise?
• In security testing, which concept describes using contextual intelligence to guide how tests are designed and conducted?
• Malware Forensics is what type of intelligence feed?
• Which Google search operator allows viewing cached versions of a webpage?
• Tim recognized noise from misrepresentation of data in large data collections and decided to apply a data-quality technique to prepare the data for analysis. Which technique did he rely on?
• Which data collection method involves no participants and relies on internal observations within the organization?
• Identify the technique to draw symbols in public places for advertising an open Wi-Fi network.
• Which Traffic Light Protocol color indicates information may be shared with the broader security community?
• In which stage of threat modeling is an analyst required to gather information about the system to identify the specific areas that need to be addressed?
• Which factors affect data reliability?
• Which stage of the Threat Intelligence Maturity Model is described as increasing CTI capabilities?
• Before distributing threat intelligence internally, what step should analysts perform?
• Which content is most likely to inform strategic decision making by illustrating the financial impact of cyber activities?
• Which MITRE standard is an application-layer protocol for sharing CTI in a simple and scalable manner?
• Which type of attack is characterized by long-term stealth and extended operation?
• Which of the following will help define the scope of the threat intelligence program?
• What is the first step in building an efficient threat intelligence program?
• What is the primary purpose of executive summaries in threat intelligence reporting?
• During a TI program, analysts convert raw data into usable information using machine-based techniques and statistics. In which phase of the TI lifecycle are they working?
• Which statement best describes the role of intelligence in decision making?
• Which analytic process must a threat intelligence manager use to identify the most consistent theory about malware?
• In threat intelligence sharing, which color of Traffic Light Protocol (TLP) indicates information should be shared only within a particular community?
• The threat assessment team has been asked to identify critical threats to the organization. Which of the following is the best strategy to use?
• Choose the best description of the differences between data, information, and intelligence.
• Which of the following is the strongest reason for limiting the number of hypotheses generated for use in the ACH process?
• Which threat information type is a pattern that can be matched against low-level data to detect malicious network activities?
• A/an ____ is the existence of a weakness which can lead to an unexpected event which compromises the security of a system.
• Steve included a list of all activities required to complete the project along with time, dependencies, and milestones to understand the relationship between activities. Which data analysis method was used?
• What is the benefit of integrating the cyber kill chain methodology with threat analysis? (Choose the BEST answer.)
• Which layer enables an adversary to navigate anonymously without being traced to perform illegal activities and cybercrimes?
• In Asset Identification, which of the following are non-physical assets?
• In CTI operations, data enrichment and indicator aggregation primarily serve to
• __________ is an analytic process that rejects hypotheses that contain too many inconsistent data points.
• Which data analysis type deals with analyzing real-time data to identify what is currently happening in the organization?
• What term describes data derived from large-scale data collection by analysts?
• Which statement best describes a key outcome of threat modeling?
• Which of the following is not part of the data analysis process?
• In threat intelligence sharing, which statement about the last phase is correct?
• What activity is most effective for identifying valuable assets and data?
• Which MITRE standard describes a machine-readable framework to model and share threat intelligence focusing on structure and relationships?
• Clark, a professional hacker, is trying to perform an APT attack to obtain administrative login credentials. Which phase of the APT lifecycle is Clark currently in?
• Why and for whom are threat intelligence sharing platforms essential capabilities?
• What action should be taken first to improve an organization's cybersecurity posture?
• What is the main source of data for technical threat intelligence collection?
• In threat intelligence, how are data, information, and intelligence related?
• Moses wants to identify fake websites hosted similar to organization's URL using advanced Google search operators. Which query should he use?
• Which intelligence discipline involves intercepts and signals from adversaries?
• How does cyber threat intelligence help businesses defend their assets and data?
• How is continuous improvement implemented in a threat intelligence program?
• Which factors are considered when designing the organization's security program?
• Sarah obtained information from sharing partners providing collections of validated and prioritized threat indicators along with detailed technical malware analysis; used at tactical and operational levels. She obtained required information from which type of sharing partner?
• Which tactic is used to collect information from human subjects?
• Indicators of Compromise (IoCs) are ____ used to build tactical threat intelligence.
• An analyst uses publicly available sources to collect information primarily for national security, law enforcement, and business decision making. Which source was used?
• Which MITRE standard focuses on representing cyber observables such as indicators of compromise?
• Threat intelligence sharing considerations indicate how intelligence can be distributed among individuals or organizations. Which factor best describes this?
• Right content, right presentation, and right time refer to what part of the threat intelligence management process?
• An offsite meeting with senior leadership to inform them about the planned implementation of a Threat Intelligence Program. Which goal is MOST important as an outcome for that meeting?
• James is executing which phase of the cyber kill chain when he creates a tailored deliverable malicious payload using an exploit and a backdoor?
• Which of the following are NOT cyber attack vectors?
• During cyber threat intelligence analysis, which stage describes understanding the nature of threats but recognizing there are unknowns to be resolved?
• Which of the following challenges to intelligence sharing has roots in legal and regulatory constraints?
• In attribution, which term links multiple intrusions to a single attacker infrastructure based on shared tactics, techniques, and procedures?
• Which type provides high-level information using OSINT, CTI vendors, ISAO/ISACs?
• Extracting an adversary's modus operandi, tools, and evasion strategies best exemplifies which category of threat intelligence?
• What is the purpose of the 'evidence' phase of the Analysis of Competing Hypotheses Process?
• A threat repository is used by analysts to ________.
• Which term is defined as a guideline that describes the way an attacker performs the attack from beginning to end?
• Identify the proactive surveillance feed.
• Which of the following companies provide threat intelligence tools?
• Which prioritization methodology is used to iteratively prioritize requirements, prioritizing the most important first?
• Which input best informs the prioritization of threats based on asset value and risk?
• Which storage approach organizes data as objects with unique identifiers and metadata, enabling scalable storage and retrieval?
• Which TLP color indicates information should be shared only within a particular community?
• Which of the following are included in the Indicators of Compromise section of an intelligence report?
• Which statement about integrating the Cyber Kill Chain with threat analysis is most accurate?
• Which combination yields the most comprehensive domain reputation assessment?
• Which practice ensures that threat intelligence deliverables meet predefined quality criteria?
• What characterizes threat modeling?
• Which of the following are used to classify threat data? (Choose the BEST answer)
• Which type uses humans, social media, and chat rooms as major sources for information about organizational threats?
• (Choose the BEST answer) Which of the following will impact the success of a cyber threat intelligence program?
• Jian conducted a real-time assessment to acquire threat intelligence feeds from honeynets, P2P monitoring, infrastructure, and application logs. Which category of threat intelligence feed does this represent?
• Joining communities to increase knowledge about emerging threats primarily supports which CTI activity?
• Which statement about standards for sharing threat intelligence information is accurate?
• In threat intelligence consumption, Tracy is best described as which type of user?
• In incident response, the use of operational and tactical threat intelligence to contextualize alerts occurs during which phase?
• Which category of information exchange would include data from IDS system logfiles?
• What type of Indicator of Compromise can be used to detect spear phishing attacks?
• Kill chain mechanism begins in which stage of Threat Analysis Process?
• Correlation of reports from multiple sources will _____.
• A counterintelligence setup uses a recursive DNS server to log responses and replicate data to a central database. Which data collection technique is described?
• Evaluated threat intelligence can be used by management to _____.
• Which data collection mechanism provides crucial information about activity related attacks?
• Host-based indicators are found on _____ systems.
• Which Building Block for Threat Intelligence Sharing is concerned with the method used to share intelligence?
• Which project management tool is used to obtain management support for a threat intelligence program?
• Which role is primarily responsible for collecting information via online job sites to inform threat intelligence?
• Which Threat Intelligence Strategy can be used to estimate and plan for the future?
• Identify the correct formula used for ranking the threats during the threat modeling process.
• From the following, identify the source of Measurement and Signature Intelligence (MASINT)?
• A threat analyst wants to incorporate a requirement in the threat knowledge repository that provides an ability to modify or delete past or irrelevant threat data. Which of the following requirement must he include in the threat knowledge repository to fulfil his needs?
• Which of the following goals is achieved by using threat modeling?
• A detailed runbook is used to ______.
• Which factor will most directly impact the success of a cyber threat intelligence program, according to the material?
• The collection and analysis of information about threats is referred to as ____.
• Which metric assesses whether threat intelligence outcomes meet stakeholders' expectations?
• Which consideration describes how to handle the dissemination of threat intelligence to ensure proper access and protection?
• What blacklisting or whitelisting tools can a threat intelligence analyst use to obtain information to prepare custom IOCs for threat detection?
• An attack is inferred when a server receives many connection requests from different geo-locations in a short time, causing degradation in performance. Which attack type is this?
• Which CTI phase would you consult to decide which intelligence objectives to pursue first?
• Which statement about Pearson correlation is true?
• Which layer of the internet allows anonymous navigation for illicit cyber activities?
• Which IoC type can be easily changed by appending a small bit, reducing its usefulness?
• What is the benefit to searching for an attacker's Command and Control (C&C) Servers ?
• In the Cyber Kill Chain, which phase involves installing access on the target after the exploit has succeeded?
• Which option best describes the relationship between vulnerability and exploit in cybersecurity?
• To define threat intelligence requirements, consumers are categorized into three groups; which includes high-level executives such as CISOs?
• TechSoft Solutions actions indicate their maturity level of CTI program described as having an organized team for strategic analysis and established processes to extract threat intelligence. Which level is this?
• Which of the following cybersecurity teams is likely to be a consumer of threat intelligence reports?
• Host-based indicators are found on which type of systems, according to the material?
• In bulk data collection for threat intelligence, which form involves data from multiple sources and formats processed to derive intelligence?
• Based on the threat intelligence maturity model, identify the level at which Guiana & Co. stands given their automation and external community involvement but reactive security posture.
• Which artifact focuses on how stakeholders will be informed and involved throughout the project?
• Which storage architecture uses centralized storage with data stored on a localized system?
• An analyst determines that Impersonation would be a good tool to use to collect information about an organization. This is an example of _____.
• Which triad is used by cyber threat analysts to profile attacks?
• Which web tool is used to access and collect data from the deep web?
• Which of the following can provide detailed intelligence reports?
• Which statement about vulnerability scanning is true?
• In threat modeling, which parameter best describes the effect on objectives if the adversary succeeds?
• What is a primary objective of the Traffic Light Protocol when sharing intelligence?
• Raw Data Producers belong in which part of the People, Processes, and Technologies framework?
• A ____ is a technical method used by an attacker.
• Which term describes a security mechanism to protect against an adversary's intelligence collection efforts?
• Which TI lifecycle phase is responsible for disseminating and integrating produced intelligence into operations?
• A threat intelligence analyst can study attacker's ____ to build a profile for threat actors.
• Which of the following is a fundamental characteristic of machine learning as applied to threat intelligence tools?
• What is information?
• Which of the following is NOT a named phase in the Cyber Kill Chain?
• What is an outcome of extracting intelligence from information and data?
• What is the difference between threat landscape reports and threat analysis reports?
• In the cleanup phase, an APT may change data on the targeted systems. Why?
• Which data source is most effective for understanding current network anomalies in real time?
• During threat analysis, John extracted MO, tools, communication channels, and forensics evasion strategies. Identify the type of threat intelligence analysis.
• Which intelligence source is publicly available and suitable for strategic decision making in business?
• Which performance metric measures the number of relevant IoCs received and prepares the organization to defend against evolving threats?
• How can an organization make sure that its threat intelligence program focuses on the most likely threats?
• Which term describes interpreted information that provides broader in-depth knowledge to support decision making and response actions to resolve complex problems?
• Which of the following directives define threat intelligence requirements for a limited timeframe?
• Data clustering is the process of ____.
• Data Clustering is the process of ____.
• Which form of intelligence is collected from an adversary's equipment or captured enemy material (CEM)?
• Which ISAC benefit enhances incident response processes?
• Which actions are included in determining domain reputation?
• Which of the following is important to successful execution of the threat intelligence program?
• Daniel's profile corresponds to which type of threat actor?
• Which component of threat intelligence enabled risk management process generates detailed information about various sources and techniques used to gather threat information that is fed as input to risk assessment?
• In de-biasing, which strategy uses learning strategic decision making in multistep interactions with multiple representatives?
• Integrating threat intelligence into an existing security infrastructure will _______.
• Which are necessary to benefit from CTI capabilities?
• Which of the following are application threat vectors?
• What is the benefit of applying a strategic lens to the threat intelligence program?
• What issue did Tim identify as causing difficulty in turning raw threat intelligence data into meaningful contextual information?
• The term best describing the purpose of threat intelligence in a business context?
• What is the defining characteristic of a risk?
• What is the most effective way to identify valuable assets and data?
• Why do attackers focus on obtaining information from Internet groups, forums, and blogs? (choose the BEST answer)
• Which capabilities must be represented among the organization's security team members?
• What is the primary aim of Planning and Direction in CTI?
• Which of the following can be used to automate OSINT data collection about a network?
• Which ISAC benefit pertains to sharing experience and lessons learned?
• Which section of a threat intelligence report explains the approach used to analyze the data?
• Under the "tiered" information sharing model, which tier requires non-disclosure agreements and, possibly, national security clearances?
• Which type of directive is used to define threat intelligence requirements of limited scope lasting a few weeks or months?
• Which type of content would likely describe ongoing campaigns and external threat activity?
• Which online sources should Alice use to gather information about emerging threats, including attacker methods and tools?
• How can an organization avoid blaming threat intelligence analysts for programmatic failures?
• Which triad is used to study and profile cyber attacks and attackers?
• After identifying threats, what is the next step in threat analysis?
• Which type of Indicator of Compromise is most useful for detecting network-based command and control traffic?
• In the threat analysis workflow, what term describes the process of escalating an indicator to a formal threat alert?
• In competing hypotheses analysis, after screening hypotheses against evidence, which stage involves resolving inconsistencies and selecting the best hypothesis?
• Attackers can be categorized by their motivations for engaging in cyber attacks. Which type of attacker is motivated by political or social agendas?
• A small organization outsourced network security monitoring to reduce resource strain. Which option is the most cost-effective method to incorporate threat intelligence into their existing defense solutions?
• In bulk data collection, which form is described as data that is structured and easily searchable due to a formal schema?
• In malware analysis, what is the primary purpose of computing file hashes?
• Threat intelligence analysts are planning an online OSINT gathering activity. Which OSINT information gathering technique is not performed online and should not be included in their plan?
• Which of the following best describes the purpose of performing website footprinting on an organization's own websites?
• Which of the following organizations publish standards and formats for sharing Threat Intelligence Information?
• In threat intelligence, which source category encompasses indicators used to detect malicious activity?
• A botnet uses a single domain name with multiple IP addresses to camouflage its phishing and malware delivery locations. Which technique is used?
• What document outlines objectives, scope, and deliverables at the start of a TI program?
• Which term is used to define the process of structuring the unstructured data to make it sorted and usable by humans as well as by automated machine tools for intelligence consumption?
• Which data analysis type is used to forecast future incidents based on historical data?
• Which analytic process is used to compare competing hypotheses about a malware sample to identify the most plausible explanation?
• Priority Intelligence Requirements (PIRs) include which of the following?
• Who coined the terms "unknown unknowns" and "known unknowns"?
• ABC's initial security posture is described as reactive. Which term best describes this approach?
• Threat intelligence feeds obtained from external sources like vendor advisories are categorized as which type?
• In system modeling, what is a 'Trust Boundary?'
• In which storage architecture is the data stored in a localized system, server, or storage hardware and capable of storing a limited amount of data in its database and locally available for data usage?
• During threat intelligence analysis, John extracted adversary MO, tools, channels, and forensics evasion strategies. Identify the type of threat intelligence analysis.
• In a threat intelligence program, which activity communicates what needs to be completed, what resources will be allocated, and the timeframe for completion?
• Which online source is commonly consulted to gather information about attack techniques, tools, and post-attack traces?
• Which of the following will maximize the return on investment for intelligence reports?
• Which analysis technique involves the identification of common methods used to launch attacks and provides insights into upcoming threats and exploits?
• In threat modeling, which stage involves identifying what needs to be protected by gathering information about the system?
• Which data visualization technique is used to visually present data by plotting data based on properties they possess?
• Which component refers to a node in the network that routes the traffic from a workstation to external command and control server and helps in identification of installed malware in the network?
• Which data characteristic should be used to estimate the amount of processing power and memory storage required for bulk data gathering?
• _____ data collection occurs when data is obtained from external networks under the control of an adversary?
• Which of the following describes the relationship between cyber threat intelligence and risk management?
• What is a 'true attribution'?
• Which tool would help determine if the web server information of an organization's site is publicly available?
• Which document formally authorizes the start of a threat intelligence program?
• Which category of threat intelligence feeds includes information gathered from proactive surveillance of external sources?
• In the context of APT characteristics, which term describes a multi-phase attack?
• What is the last phase of the Cyber Kill Chain?
• Which type of threat intelligence focuses on threat actor TTPs and is used by operations teams?
• Lizzy used a threat modeling methodology with stages Build asset-based threat profiles; Identify infrastructure vulnerabilities; Develop security strategy and plans. Which threat modeling methodology was used?
• In Cyber Kill Chain terminology, what stage involves delivering a weaponized exploit to the target?
• Which of the following statements about machine learning in threat intelligence tools is most accurate?
• What is the purpose of the reconnaissance phase of the Cyber Kill Chain?
• What is the purpose of a gap analysis when reviewing a threat intelligence program?
• What is at the bottom level of the Pyramid of Pain?
• Why would a threat analyst perform website footprinting on the company's own websites?
• Policy compliance monitoring components include which elements?
• Why should a threat team learn to use YARA rules?
• What characterizes an open threat intelligence framework in contrast to closed or proprietary frameworks?
• Which of the following is an example of unstructured data?
• Which security principle ensures information is available to authorized users when needed?
• Which intelligence category focuses on the actual artifacts and indicators used to detect and respond to threats?
• When identifying critical threats, which statement best reflects a solid prioritization approach?