22 questions · Introduction TO Threat Intelligence · All types, answers revealed
Which TWO of the following are considered 'Technical' threat intelligence sources? (Choose two)
These are direct sources of technical network intelligence.
Why this answer
Technical intelligence typically comes from logs, network traffic, and malware analysis.
You are drafting a threat report for the C-suite. Which of the following is most appropriate for this audience?
Executives require high-level summaries focusing on risk and impact.
Why this answer
Strategic intelligence, which focuses on trends and risk impact, is designed for executive audiences.
Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)
Assets like containers exist for short times, making them hard to track.
Why this answer
Cloud environments are dynamic, leading to challenges with visibility and scope.
When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?
This is the precise definition of timeliness in CTI.
Why this answer
Timeliness refers to the gap between when an event occurs and when the intelligence regarding that event is received by the analyst.
Which of the following is an example of an 'Indicator of Compromise' (IOC)?
File hashes are classic, technical IOCs.
Why this answer
An IOC is a piece of forensic evidence that indicates a system has been compromised.
In MISP, you are ingesting a CSV file of indicators. You notice that the 'Attribute' field is mapping correctly, but the 'Category' field is defaulting to 'Network activity'. What is the most efficient way to ensure the 'Category' field is parsed correctly for future imports?
Mapping templates allow users to define which CSV columns map to specific MISP fields, preventing default errors.
Why this answer
The MISP 'Import' functionality allows for template-based mapping to ensure CSV columns map to specific MISP attributes and categories correctly.
You are configuring a TAXII client to pull indicators from an external threat feed. The client returns a 403 Forbidden error despite valid credentials. Which setting should you verify in the TAXII server configuration?
A 403 Forbidden status is the standard response when the credentials provided lack authorization for the specific resource.
Why this answer
The 403 error specifically indicates that the client is authenticated but lacks the necessary permissions to access the requested Collection ID.
Your organization uses the Cyber Kill Chain. You have identified that an adversary has successfully established persistent communication with an external host. Which phase is currently active?
C2 represents the channel established for persistent control over the system.
Why this answer
Establishing persistence via a C2 channel is the definition of the Command and Control phase in the Cyber Kill Chain.
You are using the STIX 2.1 standard to document an observation. You need to link a 'Malware' object to a 'Vulnerability' object. Which Relationship object type should you use?
The 'targets' relationship correctly defines the relationship between a threat and its target vulnerability.
Why this answer
In STIX 2.1, the 'targets' relationship is used to indicate that a malware object is designed to exploit a specific vulnerability object.
Which THREE actions are typically performed during the 'Processing' phase of the threat intelligence lifecycle? (Choose three)
Deduplication is essential during processing to reduce noise.
Why this answer
Processing is where data is made usable through normalization, aggregation, and filtering.
Which TWO of the following are benefits of using a Threat Intelligence Platform (TIP)? (Choose two)
Centralization is the core purpose of a TIP.
Why this answer
TIPs centralize and automate the management of threat data.
You are assessing a threat actor's 'Capability'. Which of the following would be considered a CTI Capability indicator?
Custom malware is a core example of an adversary's capability.
Why this answer
Capability refers to the specific tools, malware, or techniques an adversary uses to achieve their objectives.
Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?
Processing is the step where raw data is structured for analysis.
Why this answer
Processing involves tasks like data normalization, translation, and decryption to make raw data ready for analysis.
Which TWO of the following are primary components of the 'Adversary' node in the Diamond Model? (Choose two)
The actor profile is the primary component of this node.
Why this answer
The Adversary node includes the actors behind the threat and their intent.
You are managing threat intelligence in a cloud-native environment. You need to identify indicators related to unauthorized API key usage in AWS. Which AWS service provides the most relevant CTI data for this investigation?
CloudTrail logs provide the event history, including the user, time, and IP address for every API call.
Why this answer
AWS CloudTrail provides the audit logs of all API calls made in the account, which is essential for identifying unauthorized usage.
During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?
Defining PIRs makes the intelligence requirement actionable.
Why this answer
Refining requirements involves transforming abstract topics into measurable intelligence needs (Priority Intelligence Requirements).
In the threat intelligence lifecycle, what is the 'Dissemination' phase primarily concerned with?
Dissemination is about the delivery of the intelligence product.
Why this answer
Dissemination focuses on ensuring the right information reaches the right person in the right format at the right time.
You are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?
C2 infrastructure is a hallmark example of the Infrastructure node.
Why this answer
The Infrastructure node in the Diamond Model describes the physical or logical communication channels used by the adversary, such as C2 servers or IP addresses.
You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?
Execution is the tactic of running code on the victim system.
Why this answer
Execution is the tactic used to run malicious code on a target system; PowerShell is a common technique within that tactic.
Which THREE factors should be considered when evaluating the reliability of a threat intelligence vendor? (Choose three)
Historical accuracy is the most important indicator of reliability.
Why this answer
Reliability is determined by the vendor's transparency, consistency, and the quality of their data collection processes.
You have received a raw feed of IP addresses. Before putting these into your firewall, you perform 'vetting'. What is the primary purpose of this vetting step?
Vetting is critical to ensure that blocking rules do not disrupt business operations.
Why this answer
Vetting prevents false positives by verifying the validity and current relevance of indicators before they affect production traffic.
You are integrating a new Threat Intelligence Platform (TIP) into your SIEM. The TIP supports the OpenIOC format. What is the primary advantage of using OpenIOC over simple CSV lists?
OpenIOC uses an XML structure that supports logic (AND, OR, NOT) and hierarchy.
Why this answer
OpenIOC allows for the expression of complex logical relationships between indicators, rather than just simple flat lists.
Ready to test yourself?
Try a timed practice session using only Introduction TO Threat Intelligence questions.