Data Analysis

When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?

Which TWO of the following are primary goals of conducting a threat modeling exercise on a new software application?

In threat modeling, what does the 'D' in DREAD risk assessment stand for?

You are utilizing the Analysis of Competing Hypotheses (ACH) matrix to evaluate a potential APT intrusion. After populating your hypotheses and evidence, you notice that your primary hypothesis has a high number of 'consistent' evidence ratings but several 'contradictory' data points. How should you proceed according to standard ACH methodology?

When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?

When analyzing network traffic for C2 communication, which THREE anomalies are common indicators of malicious activity?

You are performing a quantitative threat assessment on a high-value asset. You have a Threat Probability (P) of 0.2 and an Asset Impact (I) of $500,000. During the analysis, you find a new mitigation that reduces the probability by 50%. What is the new Annualized Loss Expectancy (ALE)?

When performing quantitative analysis, which THREE of the following are necessary to calculate the Annualized Loss Expectancy (ALE)?

In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?

Which TWO methods are effective for visualizing threat actor TTPs within a CTI report?

Which of the following is a primary benefit of using a 'Diamond Model' of intrusion analysis in your threat report?

You are reviewing your organization's threat modeling process. Which TWO of the following are considered essential components to include when documenting a threat model?

Which THREE data sources are typically analyzed when investigating an insider threat according to security behavior analytics?

In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?

What does a high 'CVSS' score indicate in the context of vulnerability data analysis?

During a threat modeling session, you are analyzing a system's 'Attack Surface'. You decide to apply the 'Least Privilege' principle. Which specific analysis technique are you practicing to reduce potential pathways?

While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?

When conducting a 'Sensitivity Analysis' on your threat model, what are you attempting to determine?

You are reviewing network traffic logs for potential C2 (Command and Control) beaconing. You decide to use a rolling average to smooth out the data. Why is this statistical technique useful in this scenario?

When conducting an Analysis of Competing Hypotheses (ACH), which TWO actions help mitigate cognitive bias in your conclusions?

You are analyzing an adversary's 'Infrastructure'. You note that they rotate IP addresses every 24 hours. Which analysis technique is most effective for mapping this persistent behavior?

Which THREE factors should be considered when evaluating the reliability of threat intelligence data used in your analysis?

Which of the following is a common pitfall when performing 'Trend Analysis' on threat data?