312-85 Introduction TO Threat Intelligence — All Questions With Answers

Question 1mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are configuring a TAXII client to pull indicators from an external threat feed. The client returns a 403 Forbidden error despite valid credentials. Which setting should you verify in the TAXII server configuration?

Question 2hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are using the STIX 2.1 standard to document an observation. You need to link a 'Malware' object to a 'Vulnerability' object. Which Relationship object type should you use?

Question 3hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You have noticed high-frequency beaconing to a domain that was recently registered. In the context of threat intelligence, how is this categorized?

Question 4mediummulti select

Read the full Introduction TO Threat Intelligence explanation →

Which TWO of the following are primary components of the 'Adversary' node in the Diamond Model? (Choose two)

Question 5hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

Which THREE of the following are considered 'Tactical' intelligence products? (Choose three)

Question 6hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

Which THREE actions are typically performed during the 'Processing' phase of the threat intelligence lifecycle? (Choose three)

Question 7hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

Which THREE of the following are examples of 'Operational' intelligence? (Choose three)

Question 8easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A small retail company has no dedicated security team and only wants to know which ransomware families are actively targeting its industry so it can prioritize patching. Which category of threat intelligence best matches this need?

Question 9mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A multinational retailer's SOC receives a finished intelligence report stating that a known ransomware group is actively targeting the retail sector with a new phishing lure. The report includes the group's name, known TTPs, and recommended mitigations. The CISO asks the threat intelligence analyst to classify this product. Which type of threat intelligence does this report represent?

Question 10hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

A threat intelligence analyst is tasked with creating a threat model for a new web application. The analyst must identify the key components of the threat intelligence process that ensure the model remains relevant and actionable. Which two of the following are essential elements of the threat intelligence lifecycle that directly support this goal? (Choose two.)

Question 11hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A threat intelligence analyst is assessing the 'reliability' of a human source who provided information about a planned attack. The source has previously provided accurate but incomplete information. According to the Admiralty Code, which rating should the analyst assign to this source?

Question 12mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A financial services firm wants to improve its defense against a specific ransomware group that has been targeting the sector. The CISO asks the threat intelligence team to produce a report that describes the group's typical intrusion techniques, the tools it uses, and how those map to observable behaviors on endpoints. Which type of threat intelligence product best fits this request?

Question 13easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?

Question 14hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

In MISP, you are ingesting a CSV file of indicators. You notice that the 'Attribute' field is mapping correctly, but the 'Category' field is defaulting to 'Network activity'. What is the most efficient way to ensure the 'Category' field is parsed correctly for future imports?

Question 15hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are managing threat intelligence in a cloud-native environment. You need to identify indicators related to unauthorized API key usage in AWS. Which AWS service provides the most relevant CTI data for this investigation?

Question 16mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?

Question 17easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

Question 18mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

Your organization uses the Cyber Kill Chain. You have identified that an adversary has successfully established persistent communication with an external host. Which phase is currently active?

Question 19mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?

Question 20easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

Which of the following is an example of an 'Indicator of Compromise' (IOC)?

Question 21easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You have received a raw feed of IP addresses. Before putting these into your firewall, you perform 'vetting'. What is the primary purpose of this vetting step?

Question 22mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are assessing a threat actor's 'Capability'. Which of the following would be considered a CTI Capability indicator?

Question 23mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are integrating a new Threat Intelligence Platform (TIP) into your SIEM. The TIP supports the OpenIOC format. What is the primary advantage of using OpenIOC over simple CSV lists?

Question 24hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?

Question 25mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are drafting a threat report for the C-suite. Which of the following is most appropriate for this audience?

Question 26mediummulti select

Read the full Introduction TO Threat Intelligence explanation →

Which TWO of the following are considered 'Technical' threat intelligence sources? (Choose two)

Question 27hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

Which THREE factors should be considered when evaluating the reliability of a threat intelligence vendor? (Choose three)

Question 28mediummulti select

Read the full Introduction TO Threat Intelligence explanation →

Which TWO of the following are benefits of using a Threat Intelligence Platform (TIP)? (Choose two)

Question 29easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

In the threat intelligence lifecycle, what is the 'Dissemination' phase primarily concerned with?

Question 30mediummulti select

Read the full Introduction TO Threat Intelligence explanation →

Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)

Question 31mediummulti select

Read the full Introduction TO Threat Intelligence explanation →

A newly formed CTI team is defining the requirements for its intelligence program. The team lead wants to ensure the program produces intelligence that is both actionable and aligned with business risk. Which TWO characteristics should the program prioritize? (Choose two.)

Question 32easymultiple choice

Read the full network assurance explanation →

A threat intelligence analyst is collecting data from various sources to understand a new malware campaign. The analyst uses both internal telemetry from the organization's SIEM and external reports from commercial threat feeds. Which term best describes the combination of these sources?

Question 33hardmultiple choice

Review the full routing breakdown →

A manufacturing firm's CTI analyst receives a report describing a new malware loader used by a financially motivated group. The report lists file hashes but no context on targeting or exploitation. The analyst must decide how to classify and route this intelligence internally. Which action best reflects sound intelligence practice?

Question 34mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A retail company's SOC manager wants to shift from reactive alert triage to a proactive posture. The CISO has approved budget for a program that will produce finished assessments about which adversaries are most likely to target the company's new contactless payment platform, why they would do so, and what business impact an intrusion would create. Which type of intelligence best matches this deliverable?

Question 35mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A financial institution's threat intelligence team is evaluating a new commercial feed. The team needs to determine if the feed provides 'actionable' intelligence. Which characteristic of the feed is most critical to this determination?

Question 36easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A junior analyst at a managed security services provider receives a feed of IP addresses and file hashes from a vendor and is told to push them to the firewall and endpoint platform for automatic blocking. What type of threat intelligence is the analyst handling?

Question 37hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A financial services firm has subscribed to three commercial threat feeds. Analysts notice that one feed consistently publishes indicators for the same campaigns as the other two but always several hours later, while a second feed publishes unique indicators that are never corroborated elsewhere. The intelligence lead wants to document these behavioral characteristics formally so consumers understand how much weight to give each feed. Which concept is the lead describing?

Question 38easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A newly hired SOC analyst is asked to explain the fundamental difference between data, information, and intelligence to a group of interns. The analyst wants to describe what specifically distinguishes finished threat intelligence from raw collected data. Which statement best describes this distinction?

Question 39easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A newly hired CTI analyst at a regional bank is asked to define the organization's intelligence requirements before any feeds are purchased. The CISO wants to ensure collection efforts remain focused and measurable. Which activity should the analyst perform FIRST?

Question 40mediummultiple choice

Read the full network assurance explanation →

An analyst receives a raw log export from a partner organization containing firewall records, proxy logs, and endpoint telemetry related to a suspected intrusion. Before any conclusions can be drawn, the analyst normalizes timestamps to UTC, deduplicates records, decodes obfuscated URLs, and translates the field names into the team's common schema. Which phase of the threat intelligence lifecycle is the analyst performing?

Question 41hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

A newly formed threat intelligence team is drafting its charter and must document the phases of the threat intelligence lifecycle it will follow, along with the feedback loop that closes the process. Which THREE of the following are recognized phases of that lifecycle? (Choose three.)

Question 42mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

An analyst is building a threat actor profile and wants to classify the group according to its primary motivation. The group consistently steals customer payment records and immediately monetizes them through underground carding forums, with no apparent political or espionage objective. Under the common CTI motivation categories, how should this group be classified?

Question 43mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A junior analyst receives a raw log export and a set of unstructured vendor advisories. Before analysis can begin, the team lead asks the analyst to normalize timestamps, deduplicate records, translate foreign-language advisories, and enrich IP addresses with geolocation. Which phase of the threat intelligence lifecycle is the analyst performing?

Question 44mediummulti select

Read the full Introduction TO Threat Intelligence explanation →

A threat intelligence team is standing up its first collection program and must classify the sources it will use. The team lead asks the analysts to identify which of the following are considered open-source intelligence (OSINT) sources for cyber threat intelligence. (Choose two.)

Question 45hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

A threat intelligence manager is briefing new analysts on the differences between strategic, operational, and tactical intelligence. Which TWO of the following products are best characterized as strategic intelligence? (Choose two.)

Question 46hardmultiple choice

Read the full network assurance explanation →

An analyst receives a report from a sharing partner containing indicators of compromise for a campaign against the energy sector. Before including these indicators in the organization's blocklists, the analyst must assess the source's reliability and the information's credibility. The partner has been accurate in past reporting but this specific report contains indicators that conflict with the organization's own telemetry. Which principle should guide the analyst's handling of this conflict?

Question 47hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

During a peer review, an analyst is challenged on a finished intelligence assessment that states with high confidence that a specific actor is responsible for an intrusion. The analyst's evidence consists of a single reused malware sample hash and a shared hosting provider. Which criticism is most valid under sound analytic standards?

Question 48mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A retail company's threat intelligence team is asked by the board to explain how the team's work reduces business risk. The analysts want to describe the primary purpose of threat intelligence within an organization. Which statement best captures that purpose?

Question 49easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A newly hired CTI analyst at a regional bank is asked to explain the fundamental difference between data, information, and intelligence as used in the threat intelligence discipline. The analyst wants to give an example that correctly places a raw indicator, an enriched observation, and an assessed conclusion into the right categories. Which statement best reflects the relationship between these three concepts?

Question 50mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A healthcare provider's CTI team is building its first intelligence program. The CISO asks the analysts to define the intelligence requirements before purchasing any feeds or tools. The analysts want to ensure the requirements are written in a way that will actually drive collection and production. Which approach best satisfies this goal?

Question 51hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

An energy utility's CTI analyst is asked to classify a collection source for an intelligence assessment. The source is a closed forum where criminal actors discuss operational security and sell access to corporate networks. The analyst must assign the correct source category and describe the handling caveat that applies. Which classification and caveat are most appropriate?

Question 52mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A government agency's CTI team produces a finished intelligence product for policymakers. The team wants to apply structured analytic techniques to reduce cognitive bias and communicate uncertainty clearly. Which practice best supports this objective?

Question 53hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

A telecommunications provider's CTI team is preparing to share finished intelligence with a trusted industry ISAC. The team must decide what to include and how to protect sensitive content. Which two practices are appropriate for sharing intelligence in this context? (Choose two.)

Question 1mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are configuring a TAXII client to pull indicators from an external threat feed. The client returns a 403 Forbidden error despite valid credentials. Which setting should you verify in the TAXII server configuration?

Question 2hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are using the STIX 2.1 standard to document an observation. You need to link a 'Malware' object to a 'Vulnerability' object. Which Relationship object type should you use?

Question 3hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You have noticed high-frequency beaconing to a domain that was recently registered. In the context of threat intelligence, how is this categorized?

Question 4mediummulti select

Read the full Introduction TO Threat Intelligence explanation →

Which TWO of the following are primary components of the 'Adversary' node in the Diamond Model? (Choose two)

Question 5hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

Which THREE of the following are considered 'Tactical' intelligence products? (Choose three)

Question 6hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

Which THREE actions are typically performed during the 'Processing' phase of the threat intelligence lifecycle? (Choose three)

Question 7hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

Which THREE of the following are examples of 'Operational' intelligence? (Choose three)

Question 8easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A small retail company has no dedicated security team and only wants to know which ransomware families are actively targeting its industry so it can prioritize patching. Which category of threat intelligence best matches this need?

Question 9mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A multinational retailer's SOC receives a finished intelligence report stating that a known ransomware group is actively targeting the retail sector with a new phishing lure. The report includes the group's name, known TTPs, and recommended mitigations. The CISO asks the threat intelligence analyst to classify this product. Which type of threat intelligence does this report represent?

Question 10hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

A threat intelligence analyst is tasked with creating a threat model for a new web application. The analyst must identify the key components of the threat intelligence process that ensure the model remains relevant and actionable. Which two of the following are essential elements of the threat intelligence lifecycle that directly support this goal? (Choose two.)

Question 11hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A threat intelligence analyst is assessing the 'reliability' of a human source who provided information about a planned attack. The source has previously provided accurate but incomplete information. According to the Admiralty Code, which rating should the analyst assign to this source?

Question 12mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A financial services firm wants to improve its defense against a specific ransomware group that has been targeting the sector. The CISO asks the threat intelligence team to produce a report that describes the group's typical intrusion techniques, the tools it uses, and how those map to observable behaviors on endpoints. Which type of threat intelligence product best fits this request?

Question 13easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?

Question 14hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

In MISP, you are ingesting a CSV file of indicators. You notice that the 'Attribute' field is mapping correctly, but the 'Category' field is defaulting to 'Network activity'. What is the most efficient way to ensure the 'Category' field is parsed correctly for future imports?

Question 15hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are managing threat intelligence in a cloud-native environment. You need to identify indicators related to unauthorized API key usage in AWS. Which AWS service provides the most relevant CTI data for this investigation?

Question 16mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?

Question 17easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

Question 18mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

Your organization uses the Cyber Kill Chain. You have identified that an adversary has successfully established persistent communication with an external host. Which phase is currently active?

Question 19mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?

Question 20easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

Which of the following is an example of an 'Indicator of Compromise' (IOC)?

Question 21easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You have received a raw feed of IP addresses. Before putting these into your firewall, you perform 'vetting'. What is the primary purpose of this vetting step?

Question 22mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are assessing a threat actor's 'Capability'. Which of the following would be considered a CTI Capability indicator?

Question 23mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are integrating a new Threat Intelligence Platform (TIP) into your SIEM. The TIP supports the OpenIOC format. What is the primary advantage of using OpenIOC over simple CSV lists?

Question 24hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?

Question 25mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

You are drafting a threat report for the C-suite. Which of the following is most appropriate for this audience?

Question 26mediummulti select

Read the full Introduction TO Threat Intelligence explanation →

Which TWO of the following are considered 'Technical' threat intelligence sources? (Choose two)

Question 27hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

Which THREE factors should be considered when evaluating the reliability of a threat intelligence vendor? (Choose three)

Question 28mediummulti select

Read the full Introduction TO Threat Intelligence explanation →

Which TWO of the following are benefits of using a Threat Intelligence Platform (TIP)? (Choose two)

Question 29easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

In the threat intelligence lifecycle, what is the 'Dissemination' phase primarily concerned with?

Question 30mediummulti select

Read the full Introduction TO Threat Intelligence explanation →

Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)

Question 31mediummulti select

Read the full Introduction TO Threat Intelligence explanation →

A newly formed CTI team is defining the requirements for its intelligence program. The team lead wants to ensure the program produces intelligence that is both actionable and aligned with business risk. Which TWO characteristics should the program prioritize? (Choose two.)

Question 32easymultiple choice

Read the full network assurance explanation →

A threat intelligence analyst is collecting data from various sources to understand a new malware campaign. The analyst uses both internal telemetry from the organization's SIEM and external reports from commercial threat feeds. Which term best describes the combination of these sources?

Question 33hardmultiple choice

Review the full routing breakdown →

A manufacturing firm's CTI analyst receives a report describing a new malware loader used by a financially motivated group. The report lists file hashes but no context on targeting or exploitation. The analyst must decide how to classify and route this intelligence internally. Which action best reflects sound intelligence practice?

Question 34mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A retail company's SOC manager wants to shift from reactive alert triage to a proactive posture. The CISO has approved budget for a program that will produce finished assessments about which adversaries are most likely to target the company's new contactless payment platform, why they would do so, and what business impact an intrusion would create. Which type of intelligence best matches this deliverable?

Question 35mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A financial institution's threat intelligence team is evaluating a new commercial feed. The team needs to determine if the feed provides 'actionable' intelligence. Which characteristic of the feed is most critical to this determination?

Question 36easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A junior analyst at a managed security services provider receives a feed of IP addresses and file hashes from a vendor and is told to push them to the firewall and endpoint platform for automatic blocking. What type of threat intelligence is the analyst handling?

Question 37hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A financial services firm has subscribed to three commercial threat feeds. Analysts notice that one feed consistently publishes indicators for the same campaigns as the other two but always several hours later, while a second feed publishes unique indicators that are never corroborated elsewhere. The intelligence lead wants to document these behavioral characteristics formally so consumers understand how much weight to give each feed. Which concept is the lead describing?

Question 38easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A newly hired SOC analyst is asked to explain the fundamental difference between data, information, and intelligence to a group of interns. The analyst wants to describe what specifically distinguishes finished threat intelligence from raw collected data. Which statement best describes this distinction?

Question 39easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A newly hired CTI analyst at a regional bank is asked to define the organization's intelligence requirements before any feeds are purchased. The CISO wants to ensure collection efforts remain focused and measurable. Which activity should the analyst perform FIRST?

Question 40mediummultiple choice

Read the full network assurance explanation →

An analyst receives a raw log export from a partner organization containing firewall records, proxy logs, and endpoint telemetry related to a suspected intrusion. Before any conclusions can be drawn, the analyst normalizes timestamps to UTC, deduplicates records, decodes obfuscated URLs, and translates the field names into the team's common schema. Which phase of the threat intelligence lifecycle is the analyst performing?

Question 41hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

A newly formed threat intelligence team is drafting its charter and must document the phases of the threat intelligence lifecycle it will follow, along with the feedback loop that closes the process. Which THREE of the following are recognized phases of that lifecycle? (Choose three.)

Question 42mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

An analyst is building a threat actor profile and wants to classify the group according to its primary motivation. The group consistently steals customer payment records and immediately monetizes them through underground carding forums, with no apparent political or espionage objective. Under the common CTI motivation categories, how should this group be classified?

Question 43mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A junior analyst receives a raw log export and a set of unstructured vendor advisories. Before analysis can begin, the team lead asks the analyst to normalize timestamps, deduplicate records, translate foreign-language advisories, and enrich IP addresses with geolocation. Which phase of the threat intelligence lifecycle is the analyst performing?

Question 44mediummulti select

Read the full Introduction TO Threat Intelligence explanation →

A threat intelligence team is standing up its first collection program and must classify the sources it will use. The team lead asks the analysts to identify which of the following are considered open-source intelligence (OSINT) sources for cyber threat intelligence. (Choose two.)

Question 45hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

A threat intelligence manager is briefing new analysts on the differences between strategic, operational, and tactical intelligence. Which TWO of the following products are best characterized as strategic intelligence? (Choose two.)

Question 46hardmultiple choice

Read the full network assurance explanation →

An analyst receives a report from a sharing partner containing indicators of compromise for a campaign against the energy sector. Before including these indicators in the organization's blocklists, the analyst must assess the source's reliability and the information's credibility. The partner has been accurate in past reporting but this specific report contains indicators that conflict with the organization's own telemetry. Which principle should guide the analyst's handling of this conflict?

Question 47hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

During a peer review, an analyst is challenged on a finished intelligence assessment that states with high confidence that a specific actor is responsible for an intrusion. The analyst's evidence consists of a single reused malware sample hash and a shared hosting provider. Which criticism is most valid under sound analytic standards?

Question 48mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A retail company's threat intelligence team is asked by the board to explain how the team's work reduces business risk. The analysts want to describe the primary purpose of threat intelligence within an organization. Which statement best captures that purpose?

Question 49easymultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A newly hired CTI analyst at a regional bank is asked to explain the fundamental difference between data, information, and intelligence as used in the threat intelligence discipline. The analyst wants to give an example that correctly places a raw indicator, an enriched observation, and an assessed conclusion into the right categories. Which statement best reflects the relationship between these three concepts?

Question 50mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A healthcare provider's CTI team is building its first intelligence program. The CISO asks the analysts to define the intelligence requirements before purchasing any feeds or tools. The analysts want to ensure the requirements are written in a way that will actually drive collection and production. Which approach best satisfies this goal?

Question 51hardmultiple choice

Read the full Introduction TO Threat Intelligence explanation →

An energy utility's CTI analyst is asked to classify a collection source for an intelligence assessment. The source is a closed forum where criminal actors discuss operational security and sell access to corporate networks. The analyst must assign the correct source category and describe the handling caveat that applies. Which classification and caveat are most appropriate?

Question 52mediummultiple choice

Read the full Introduction TO Threat Intelligence explanation →

A government agency's CTI team produces a finished intelligence product for policymakers. The team wants to apply structured analytic techniques to reduce cognitive bias and communicate uncertainty clearly. Which practice best supports this objective?

Question 53hardmulti select

Read the full Introduction TO Threat Intelligence explanation →

A telecommunications provider's CTI team is preparing to share finished intelligence with a trusted industry ISAC. The team must decide what to include and how to protect sensitive content. Which two practices are appropriate for sharing intelligence in this context? (Choose two.)