Introduction TO Threat Intelligence

You are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?

In MISP, you are ingesting a CSV file of indicators. You notice that the 'Attribute' field is mapping correctly, but the 'Category' field is defaulting to 'Network activity'. What is the most efficient way to ensure the 'Category' field is parsed correctly for future imports?

You are managing threat intelligence in a cloud-native environment. You need to identify indicators related to unauthorized API key usage in AWS. Which AWS service provides the most relevant CTI data for this investigation?

During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

Your organization uses the Cyber Kill Chain. You have identified that an adversary has successfully established persistent communication with an external host. Which phase is currently active?

When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?

Which of the following is an example of an 'Indicator of Compromise' (IOC)?

You have received a raw feed of IP addresses. Before putting these into your firewall, you perform 'vetting'. What is the primary purpose of this vetting step?

You are assessing a threat actor's 'Capability'. Which of the following would be considered a CTI Capability indicator?

You are integrating a new Threat Intelligence Platform (TIP) into your SIEM. The TIP supports the OpenIOC format. What is the primary advantage of using OpenIOC over simple CSV lists?

You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?

You are drafting a threat report for the C-suite. Which of the following is most appropriate for this audience?

Which TWO of the following are considered 'Technical' threat intelligence sources? (Choose two)

Which THREE factors should be considered when evaluating the reliability of a threat intelligence vendor? (Choose three)

Which TWO of the following are benefits of using a Threat Intelligence Platform (TIP)? (Choose two)

In the threat intelligence lifecycle, what is the 'Dissemination' phase primarily concerned with?

Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)

A newly formed CTI team is defining the requirements for its intelligence program. The team lead wants to ensure the program produces intelligence that is both actionable and aligned with business risk. Which TWO characteristics should the program prioritize? (Choose two.)

A threat intelligence analyst is collecting data from various sources to understand a new malware campaign. The analyst uses both internal telemetry from the organization's SIEM and external reports from commercial threat feeds. Which term best describes the combination of these sources?

A manufacturing firm's CTI analyst receives a report describing a new malware loader used by a financially motivated group. The report lists file hashes but no context on targeting or exploitation. The analyst must decide how to classify and route this intelligence internally. Which action best reflects sound intelligence practice?

A retail company's SOC manager wants to shift from reactive alert triage to a proactive posture. The CISO has approved budget for a program that will produce finished assessments about which adversaries are most likely to target the company's new contactless payment platform, why they would do so, and what business impact an intrusion would create. Which type of intelligence best matches this deliverable?

A financial institution's threat intelligence team is evaluating a new commercial feed. The team needs to determine if the feed provides 'actionable' intelligence. Which characteristic of the feed is most critical to this determination?

A junior analyst at a managed security services provider receives a feed of IP addresses and file hashes from a vendor and is told to push them to the firewall and endpoint platform for automatic blocking. What type of threat intelligence is the analyst handling?

A financial services firm has subscribed to three commercial threat feeds. Analysts notice that one feed consistently publishes indicators for the same campaigns as the other two but always several hours later, while a second feed publishes unique indicators that are never corroborated elsewhere. The intelligence lead wants to document these behavioral characteristics formally so consumers understand how much weight to give each feed. Which concept is the lead describing?

A newly hired SOC analyst is asked to explain the fundamental difference between data, information, and intelligence to a group of interns. The analyst wants to describe what specifically distinguishes finished threat intelligence from raw collected data. Which statement best describes this distinction?

A newly hired CTI analyst at a regional bank is asked to define the organization's intelligence requirements before any feeds are purchased. The CISO wants to ensure collection efforts remain focused and measurable. Which activity should the analyst perform FIRST?

An analyst receives a raw log export from a partner organization containing firewall records, proxy logs, and endpoint telemetry related to a suspected intrusion. Before any conclusions can be drawn, the analyst normalizes timestamps to UTC, deduplicates records, decodes obfuscated URLs, and translates the field names into the team's common schema. Which phase of the threat intelligence lifecycle is the analyst performing?

A newly formed threat intelligence team is drafting its charter and must document the phases of the threat intelligence lifecycle it will follow, along with the feedback loop that closes the process. Which THREE of the following are recognized phases of that lifecycle? (Choose three.)

An analyst is building a threat actor profile and wants to classify the group according to its primary motivation. The group consistently steals customer payment records and immediately monetizes them through underground carding forums, with no apparent political or espionage objective. Under the common CTI motivation categories, how should this group be classified?

A junior analyst receives a raw log export and a set of unstructured vendor advisories. Before analysis can begin, the team lead asks the analyst to normalize timestamps, deduplicate records, translate foreign-language advisories, and enrich IP addresses with geolocation. Which phase of the threat intelligence lifecycle is the analyst performing?

A threat intelligence team is standing up its first collection program and must classify the sources it will use. The team lead asks the analysts to identify which of the following are considered open-source intelligence (OSINT) sources for cyber threat intelligence. (Choose two.)

A threat intelligence manager is briefing new analysts on the differences between strategic, operational, and tactical intelligence. Which TWO of the following products are best characterized as strategic intelligence? (Choose two.)

An analyst receives a report from a sharing partner containing indicators of compromise for a campaign against the energy sector. Before including these indicators in the organization's blocklists, the analyst must assess the source's reliability and the information's credibility. The partner has been accurate in past reporting but this specific report contains indicators that conflict with the organization's own telemetry. Which principle should guide the analyst's handling of this conflict?

During a peer review, an analyst is challenged on a finished intelligence assessment that states with high confidence that a specific actor is responsible for an intrusion. The analyst's evidence consists of a single reused malware sample hash and a shared hosting provider. Which criticism is most valid under sound analytic standards?

A retail company's threat intelligence team is asked by the board to explain how the team's work reduces business risk. The analysts want to describe the primary purpose of threat intelligence within an organization. Which statement best captures that purpose?

A newly hired CTI analyst at a regional bank is asked to explain the fundamental difference between data, information, and intelligence as used in the threat intelligence discipline. The analyst wants to give an example that correctly places a raw indicator, an enriched observation, and an assessed conclusion into the right categories. Which statement best reflects the relationship between these three concepts?

A healthcare provider's CTI team is building its first intelligence program. The CISO asks the analysts to define the intelligence requirements before purchasing any feeds or tools. The analysts want to ensure the requirements are written in a way that will actually drive collection and production. Which approach best satisfies this goal?

An energy utility's CTI analyst is asked to classify a collection source for an intelligence assessment. The source is a closed forum where criminal actors discuss operational security and sell access to corporate networks. The analyst must assign the correct source category and describe the handling caveat that applies. Which classification and caveat are most appropriate?

A government agency's CTI team produces a finished intelligence product for policymakers. The team wants to apply structured analytic techniques to reduce cognitive bias and communicate uncertainty clearly. Which practice best supports this objective?

A telecommunications provider's CTI team is preparing to share finished intelligence with a trusted industry ISAC. The team must decide what to include and how to protect sensitive content. Which two practices are appropriate for sharing intelligence in this context? (Choose two.)