You are performing a quantitative threat assessment on a high-value asset. You have a Threat Probability (P) of 0.2 and an Asset Impact (I) of $500,000. During the analysis, you find a new mitigation that reduces the probability by 50%. What is the new Annualized Loss Expectancy (ALE)?
You are utilizing the Analysis of Competing Hypotheses (ACH) matrix to evaluate a potential APT intrusion. After populating your hypotheses and evidence, you notice that your primary hypothesis has a high number of 'consistent' evidence ratings but several 'contradictory' data points. How should you proceed according to standard ACH methodology?
You are tasked with evaluating the validity of a threat intelligence report provided by an external vendor. You choose to use ACH. What is the very first step you must take before populating the matrix?
During a threat modeling session, you are analyzing a system's 'Attack Surface'. You decide to apply the 'Least Privilege' principle. Which specific analysis technique are you practicing to reduce potential pathways?
You are using the 'Kill Chain' model to analyze an incident. The logs show the adversary successfully gained credentials via phishing. Which phase does this correlate to?
A threat intelligence analyst is reviewing a PCAP file and notices that a compromised host is sending DNS queries for domains that are algorithmically generated, such as 'ajk3n2l4kj.com', 'pq8r7s6t5u.com', and 'zx1c2v3b4n.com'. The queries occur at regular intervals, and the responses are always NXDOMAIN except for one domain that resolves to an IP address. Which type of malware behavior is MOST likely indicated?
When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?
While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?
In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?
When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?
You are reviewing network traffic logs for potential C2 (Command and Control) beaconing. You decide to use a rolling average to smooth out the data. Why is this statistical technique useful in this scenario?
You are analyzing an adversary's 'Infrastructure'. You note that they rotate IP addresses every 24 hours. Which analysis technique is most effective for mapping this persistent behavior?
You are reviewing your organization's threat modeling process. Which TWO of the following are considered essential components to include when documenting a threat model?
You are analyzing an intrusion set and need to assess how consistently a specific adversary group has targeted your industry over the past 18 months. You have a feed of 4,200 indicators, but 3,100 of them are domain names that resolve to shared CDN infrastructure used by thousands of legitimate sites. Which structured analytic technique is MOST appropriate to reduce this noise before you draw conclusions about targeting patterns?
A junior analyst presents a chart showing that malware detections in your environment dropped 40 percent after a new endpoint agent was deployed. You suspect the chart is misleading because the agent only covers Windows servers, while the previous agent covered servers and workstations. Which analytic step should you take FIRST to validate whether the apparent drop is real?
During a threat intelligence analysis, you are examining a large dataset of network flow records. You notice a significant number of outbound connections from internal hosts to a known malicious IP address on port 443, but the connections are short-lived and occur at regular intervals. Which of the following best describes the adversary behavior you are observing?
You are building a link analysis chart to map an intrusion set's operational infrastructure. You have collected domain registrations, malware sample hashes, and command-and-control IP addresses, but you need to select additional data elements that will produce meaningful links rather than coincidental ones. (Choose two.)
You are an analyst at a financial services firm. Your team has collected a large set of indicators of compromise (IOCs) from an open-source feed. Before integrating them into your SIEM for automated blocking, you need to perform data enrichment. Which of the following best describes the primary goal of enriching these IOCs with contextual data?
You are reviewing a threat intelligence report that includes an indicator of compromise (IoC) in the form of a file hash. The report states that the hash is 'SHA-256: 8f14e45fceea167a5a36dedd4bea2543...'. What is the primary purpose of including this hash in the report?
You are analyzing a malware sample that communicates with a command-and-control (C2) server. The network traffic shows periodic HTTP GET requests to a domain that resolves to multiple IP addresses, and the User-Agent string is identical across all requests. Which of the following analytical techniques would best help you identify the infrastructure and potential attribution of the threat actor?
During a malware analysis engagement, you receive a sample whose import table references the Windows API functions VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. Which analytical conclusion is best supported by this evidence?
You are analyzing a Linux server that is suspected of being compromised. You observe a process named 'kworker' that is consuming high CPU, but when you check the parent process ID (PPID), it is 1 (init). Which of the following is the most likely explanation for this observation?
You are a threat intelligence analyst at a healthcare organization. Your team is developing a threat model for a new telemedicine platform. You need to identify potential threat actors and their capabilities. Which two of the following factors are most critical to consider when assessing threat actor intent and capability? (Choose two.)
You are conducting a threat intelligence analysis on a recent cyber espionage campaign. You have collected various data points and need to assess the credibility of the intelligence. Which two of the following factors are most critical in evaluating the reliability of the threat data? (Choose two.)
You are reviewing a large NetFlow data set and observe an internal workstation sending 40-byte UDP packets to a single external IP address every 60 seconds for several days, with almost no return traffic. Which analytic interpretation is most appropriate?
A SOC analyst is building a hypothesis set to explain a suspected data exfiltration event. She creates five mutually exclusive hypotheses and then scores each piece of evidence for consistency with every hypothesis. After scoring, she notices that one hypothesis has the highest total consistency score, but the evidence is sparse and several items are ambiguous. What should she do before finalizing her assessment?
You are reviewing a threat intelligence report that includes a list of indicators. You notice that one indicator is an IP address with a low confidence score. According to best practices, what should you do before using this indicator for detection?
An analyst is enriching indicators of compromise before publishing them for detection engineering. Which action best reflects sound intelligence preparation for an IP address indicator?
A threat intelligence team is correlating indicators from multiple feeds. They observe that a set of domain names resolves to fast-flux IP addresses, the domains were registered within the last 48 hours, and the same SSL certificate serial number appears across several unrelated domains. Which analytic conclusion is best supported by this evidence?
You are analyzing a large set of security events to identify patterns of malicious activity. You decide to use a pivot table to summarize the data by source IP and event type. Which of the following is the primary benefit of using pivot tables in threat data analysis?
You are correlating host and network telemetry after an intrusion and need to establish which account was used to move laterally between servers. Which two data sources are most directly useful for this determination? (Choose two.)
A threat intelligence analyst is preparing to analyze a large set of intrusion artifacts collected from multiple sensors. She wants to apply structured analysis techniques to reduce bias and improve the defensibility of her conclusions. Which two techniques are most appropriate for this goal? (Choose two.)
An analyst is reviewing a threat intelligence report that includes a list of IP addresses, domain names, and file hashes associated with a recent campaign. The report states that these indicators were observed on multiple victim networks over the past month. What is the most appropriate first step before using these indicators in detection rules?
A threat intelligence analyst is examining a malware sample and observes that the binary contains a hardcoded list of domain names that are contacted in a fixed order, with a fallback to a DGA-generated domain if the first three fail. The analyst wants to characterize the command-and-control resilience of this malware. Which statement best describes the resilience of this C2 approach?
A threat intelligence analyst is examining a malware sample and notices that the executable's import table contains only two functions from kernel32.dll: LoadLibraryA and GetProcAddress. The analyst suspects the sample is designed to evade static analysis. Which technique is MOST likely being used?
A threat intelligence analyst is tasked with enriching indicators of compromise (IOCs) from a recent malware campaign. The analyst has a list of file hashes and wants to gather additional context to support incident response. Which TWO of the following actions would BEST provide actionable intelligence about the malware's capabilities and infrastructure? (Choose two.)
A threat intelligence analyst is examining a malware sample that uses a technique to hide its presence by injecting code into a legitimate process. The analyst observes that the malware creates a new process in a suspended state, unmaps its memory, and replaces it with malicious code. Which technique is being used?
A threat intelligence analyst is investigating a malware sample that communicates with a command-and-control (C2) server using a custom protocol over TCP port 443. The traffic is encrypted and does not match typical TLS patterns. The analyst observes that the malware sends a small beacon every 60 seconds, and the server responds with a similarly sized packet. Which analysis approach would BEST help the analyst understand the C2 protocol and extract potential indicators?