scenario questions

You are an intelligence analyst tasked with disseminating a tactical threat intelligence report to your organization's SOC analysts. The report contains specific IOCs and TTPs that need to be acted upon quickly. Which dissemination method is most appropriate for ensuring timely and actionable delivery to the SOC?

Which of the following is considered an 'Indicator of Attack' (IOA) rather than an IOC?

When utilizing the MITRE ATT&CK framework for data analysis, you identify that an actor is using 'DLL Side-Loading'. Which analytical technique should you apply to map this observation to the ATT&CK matrix?

Which TWO of the following are considered 'Technical' threat intelligence sources? (Choose two)

A threat intelligence team ingests a daily feed delivered as a single JSON file. Each record includes an indicator value, a confidence score, and a free-text description. During processing, the team must enrich each indicator with internal asset context and geographic location before loading it into a MISP event. Which action should be performed first to ensure the enrichment stage has clean, normalized records?

Which TWO of the following are primary goals of conducting a threat modeling exercise on a new software application?

A threat hunter wants to identify unauthorized DNS tunneling. Which data point is most indicative of this activity?

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

An analyst is collecting threat intelligence from a new OSINT source that provides indicators in a structured format. The analyst needs to ensure that the data is ingested into the threat intelligence platform (TIP) without manual reformatting. Which data format is most commonly supported by TIPs for automated ingestion?

A junior analyst is tasked with creating a report for the SOC manager on the current threat landscape. The analyst has collected data from various sources, including open-source reports, internal incident tickets, and premium feeds. Which phase of the threat intelligence lifecycle should the analyst focus on to ensure the report is tailored to the organization's specific needs?

A threat intelligence analyst is collecting data from a dark web forum to identify emerging threats. The analyst uses a web scraping tool that automatically extracts posts and user metadata. After several hours, the tool is blocked and the analyst's IP is banned. Which of the following is the most likely cause of the block, and what should the analyst have implemented to prevent it?

A threat intelligence analyst is reviewing the Cyber Kill Chain phases for a recent intrusion. The analyst observes that the adversary successfully exploited a vulnerability in a public-facing web server to gain a foothold. Which phase of the Cyber Kill Chain does this activity represent?

A threat hunter is reviewing PowerShell operational logs collected via Windows Event Forwarding and notices Event ID 4104 entries that contain a script block defining a function which, when invoked, calls System.Net.WebClient.DownloadString with a hard-coded IP address and then passes the returned content to Invoke-Expression. The parent process is winword.exe. Which hunting conclusion is most defensible?

You are drafting an executive threat report and need to adhere to the Traffic Light Protocol (TLP). The report contains sensitive information about an ongoing vulnerability in a zero-day exploit that could cause irreparable damage if leaked. Which TLP color should be applied?

A threat intelligence analyst is analyzing a cyber attack campaign and wants to apply the Diamond Model of Intrusion Analysis. The analyst has identified the victim and the infrastructure used by the attacker. Which TWO additional core features of the Diamond Model should the analyst identify to complete the model? (Choose two.)

A CTI analyst is conducting a review of the intelligence program after six months of operation. The review reveals that several PIRs are no longer relevant due to a recent merger and acquisition. The analyst must realign the intelligence requirements with the new business strategy. Which of the following activities should the analyst perform FIRST to ensure the requirements remain effective?

A threat intelligence analyst is processing a set of indicators and needs to ensure that the data is properly enriched and contextualized before dissemination. Which TWO of the following actions are appropriate during the processing phase of the threat intelligence lifecycle? (Choose two.)

A threat hunter is asked to determine whether a suspected intrusion involved beaconing over HTTPS to an external command-and-control server. The organization has full network metadata but no TLS interception. Which hunting approach is most appropriate to identify beaconing behavior without decrypting traffic?

A CTI analyst is developing a set of Specific Intelligence Requirements (SIRs) to support the organization's PIRs. The analyst must ensure that each SIR is measurable and time-bound. Which of the following is the BEST example of a well-formulated SIR?

You are reviewing a threat intelligence report regarding a new malware variant. Which section of the report is most critical for your incident responders to identify local presence of the infection?

A threat intelligence analyst is assessing an adversary's use of the 'Kill Chain' model. The analyst notes that the adversary has successfully delivered a malicious payload to the target and is now establishing a command-and-control (C2) channel. Which phase of the Cyber Kill Chain does this activity represent?

You are drafting a threat report for the C-suite. Which of the following is most appropriate for this audience?

Which TWO of the following actions are considered 'Defense Evasion' techniques?

Which TWO artifacts are most important when investigating a possible 'Fileless Malware' infection?

A CTI analyst is conducting a review of the intelligence requirements after a series of false positives from automated collection tools. The review aims to refine the requirements to reduce noise. Which of the following actions best addresses this issue?

You are reviewing a large NetFlow data set and observe an internal workstation sending 40-byte UDP packets to a single external IP address every 60 seconds for several days, with almost no return traffic. Which analytic interpretation is most appropriate?

You are analyzing an intrusion set and need to assess how consistently a specific adversary group has targeted your industry over the past 18 months. You have a feed of 4,200 indicators, but 3,100 of them are domain names that resolve to shared CDN infrastructure used by thousands of legitimate sites. Which structured analytic technique is MOST appropriate to reduce this noise before you draw conclusions about targeting patterns?

A threat intelligence analyst is collecting data from various sources to understand a new malware campaign. The analyst uses both internal telemetry from the organization's SIEM and external reports from commercial threat feeds. Which term best describes the combination of these sources?

A threat intelligence analyst is building a report on an advanced persistent threat (APT) group that has been observed targeting a government contractor. The analyst wants to characterize the group's operational infrastructure using the Diamond Model of Intrusion Analysis. Which TWO of the following activities would the analyst classify as belonging to the Infrastructure axis? (Choose two.)

In threat modeling, what does the 'D' in DREAD risk assessment stand for?

Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)

A CTI analyst is drafting intelligence requirements for a new program. The analyst wants to ensure that each requirement is actionable and can be used to guide collection. Which of the following is the most important characteristic of a well-written intelligence requirement?

You are a CTI analyst and need to share a report marked TLP:AMBER with a trusted partner. What is the correct handling procedure for this report?

You are conducting threat intelligence research on a newly discovered APT group. You have collected various data points. Which TWO of the following are considered Tactics, Techniques, and Procedures (TTPs) according to the MITRE ATT&CK framework? (Choose two.)

Which TWO command-line parameters are highly suspicious when observed with 'powershell.exe' in your telemetry?

You are an analyst at a financial services firm. Your team has collected a large set of indicators of compromise (IOCs) from an open-source feed. Before integrating them into your SIEM for automated blocking, you need to perform data enrichment. Which of the following best describes the primary goal of enriching these IOCs with contextual data?

A CTI analyst is tasked with creating a collection plan for a new intelligence requirement focused on advanced persistent threat (APT) actors targeting the organization's cloud infrastructure. The analyst must consider various factors to ensure the plan is effective. Which TWO of the following are essential components of an effective collection plan for this requirement? (Choose two.)

Which THREE of the following are common attributes used to characterize an 'Observed Data' object in STIX 2.1?

A CTI team is conducting a requirements review with stakeholders to ensure the intelligence program remains aligned with business objectives. Which TWO activities are essential during this review? (Choose two.)

Which THREE factors should be considered when assessing the 'relevance' of a threat intelligence feed for your organization?

You are drafting a threat intelligence report for an internal audience that includes both technical staff and non-technical executives. The report contains actionable indicators and a strategic assessment. Which intelligence reporting approach best serves this mixed audience?

You are an analyst at a government agency. You need to share a threat intelligence report with a trusted partner in the private sector. The report contains indicators that are sensitive and should not be shared publicly. Which dissemination method is most appropriate?

A junior analyst receives a raw log export and a set of unstructured vendor advisories. Before analysis can begin, the team lead asks the analyst to normalize timestamps, deduplicate records, translate foreign-language advisories, and enrich IP addresses with geolocation. Which phase of the threat intelligence lifecycle is the analyst performing?

A regulatory body requires your firm to report incidents using the 'Admiralty Code' for source reliability and information credibility. If you receive a report from a highly trusted partner that has been verified through multiple independent sources, which code should you assign?

A threat intelligence analyst is tracking an adversary that has been observed using a unique, custom-built backdoor. The analyst wants to attribute the activity to a known threat group. According to the Diamond Model, which axis should the analyst focus on to link this activity to other events?

Which tool is most effective for visualizing the parent-child process relationships during a threat hunt?

You are an intelligence analyst tasked with disseminating a tactical threat report to your organization's security operations center (SOC). The report includes specific indicators of compromise (IOCs) and recommended detection rules. Which dissemination method is most appropriate to ensure the SOC can rapidly ingest and act on the IOCs?

A CTI program is conducting a formal review of its intelligence requirements to ensure alignment with changing business goals. Which phase of the intelligence cycle directly feeds into the direction and planning phase during this review?

An adversary uses a custom script to modify 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Which MITRE ATT&CK technique is this?

Which THREE of the following are core components of the STIX 2.1 Domain Object (SDO) structure?

Which TWO items are part of the 'Adversary' vertex in the Diamond Model?

When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?

You are responsible for disseminating threat intelligence to both technical and non-technical stakeholders within your organization. To ensure effective communication, which two of the following practices should you follow? (Choose two.)

Which of the following is an example of an 'Indicator of Compromise' (IOC)?

When performing statistical analysis on threat actor TTP frequency, you identify a set of outliers that do not fit the normal distribution of observed incident timestamps. Which statistical measure should you apply to determine if these outliers are significant enough to warrant a change in threat modeling?

A global manufacturing company is establishing a new CTI program. The CISO wants to ensure that intelligence production remains focused on the organization's most critical business assets and that resources are allocated efficiently. Which of the following should the CTI manager produce FIRST to define the specific intelligence needs that support strategic decision-making?

A threat hunter wants to detect adversary use of scheduled tasks for persistence on Windows endpoints and has Sysmon deployed with a configuration that includes process creation and file creation events. Which approach gives the most direct and reliable detection coverage for newly created scheduled tasks?

A threat intelligence analyst is drafting a report for external dissemination. The report includes indicators of compromise (IOCs) that are marked TLP:GREEN. Which of the following best describes the permitted sharing scope for this report?

During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?

A threat intelligence analyst is reviewing a report that describes an adversary's operational approach using a model that maps phases from reconnaissance through to achieving the final mission. The report specifically highlights that the adversary spent weeks performing open-source research on employees and technical infrastructure before any exploitation attempt. In the Lockheed Martin Cyber Kill Chain, which phase is being described?

You are correlating host and network telemetry after an intrusion and need to establish which account was used to move laterally between servers. Which two data sources are most directly useful for this determination? (Choose two.)

You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?

A retail company's newly appointed CTI lead is defining the direction phase for the coming year. The Chief Information Security Officer asks her to document how intelligence requirements will be gathered from the business and turned into a prioritized set of questions the team must answer. Which deliverable best represents the output of the direction phase?

An organization is updating its threat landscape analysis methodology to better account for sector-specific threats. Which stakeholder group should the CTI team primarily consult to gather accurate sector-specific threat requirements?

When analyzing network traffic for C2 communication, which THREE anomalies are common indicators of malicious activity?

You are hunting for unauthorized scheduled tasks. Which PowerShell cmdlet allows you to audit these tasks remotely across the enterprise?

You are analyzing a large set of security events to identify patterns of malicious activity. You decide to use a pivot table to summarize the data by source IP and event type. Which of the following is the primary benefit of using pivot tables in threat data analysis?

An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?

You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?

An analyst is hunting for unauthorized network connections. Which port is commonly associated with SMB, frequently used for lateral movement (e.g., PSExec)?

In MISP, you are ingesting a CSV file of indicators. You notice that the 'Attribute' field is mapping correctly, but the 'Category' field is defaulting to 'Network activity'. What is the most efficient way to ensure the 'Category' field is parsed correctly for future imports?

A CTI manager is conducting a formal review of the intelligence program to ensure it remains aligned with business goals. The review will assess the effectiveness of the requirements planning, direction, and review phases. Which TWO activities are essential components of the review phase in the intelligence cycle? (Choose two.)

A threat intelligence manager is briefing new analysts on the differences between strategic, operational, and tactical intelligence. Which TWO of the following products are best characterized as strategic intelligence? (Choose two.)

A CTI team is conducting a periodic review of its intelligence requirements. The team notices that several requirements have not generated any collection or analysis in the past six months. Which of the following is the MOST appropriate action for the team to take?

A newly hired CTI analyst at a regional bank is asked to define the organization's intelligence requirements before any feeds are purchased. The CISO wants to ensure collection efforts remain focused and measurable. Which activity should the analyst perform FIRST?

When establishing a Threat Intelligence program, a manager must outline the core functions of the TI team. Which TWO of the following responsibilities typically fall under a dedicated CTI team's scope? (Choose TWO)

A newly appointed CTI lead at a financial services firm is asked to align the intelligence program with the business’s strategic risk appetite. The executive team wants to know how CTI will support decisions about mergers and acquisitions. Which of the following best describes the primary purpose of defining Priority Intelligence Requirements (PIRs) in this context?

A newly hired CTI analyst at a regional bank is asked to explain the fundamental difference between data, information, and intelligence as used in the threat intelligence discipline. The analyst wants to give an example that correctly places a raw indicator, an enriched observation, and an assessed conclusion into the right categories. Which statement best reflects the relationship between these three concepts?

You are a CTI analyst responsible for disseminating a finished intelligence report to multiple stakeholders within your organization, including the SOC, the vulnerability management team, and the CISO. The report contains both tactical indicators and strategic recommendations. What is the most effective way to structure the dissemination to ensure each stakeholder receives the relevant information?

A threat intelligence team is standing up its first collection program and must classify the sources it will use. The team lead asks the analysts to identify which of the following are considered open-source intelligence (OSINT) sources for cyber threat intelligence. (Choose two.)

A CTI manager is conducting a requirements review with stakeholders from legal, IT, and business units. During the meeting, the legal team requests intelligence on data breach notification laws in all 50 U.S. states. The CTI team currently has no collection sources for legal research. Which action should the CTI manager take FIRST to address this request?

Your organization uses the Cyber Kill Chain. You have identified that an adversary has successfully established persistent communication with an external host. Which phase is currently active?

You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?

An analyst is processing a set of indicators received in a CSV file. The file contains a column labeled 'ip_address' with values such as '192.168.1.1' and '10.0.0.1'. The analyst needs to import these into a threat intelligence platform that expects indicators to be classified by type. Which of the following actions should the analyst take to ensure proper classification?

While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?

Which THREE phases of the Cyber Kill Chain focus on the attacker's activities before reaching the target environment?

A junior analyst receives a CSV export from a partner that contains a column named 'indicator' with values such as 'hxxp://malicious[.]example[.]com/path'. The analyst needs to prepare these values for ingestion into a threat intelligence platform that expects defanged indicators to be normalized. Which action should the analyst take?

You are configuring a SIEM to ingest STIX/TAXII feeds. What is the benefit of setting an 'Expiration' time on ingested indicators?

Your SOC has just onboarded a new premium threat intelligence feed that delivers atomic indicators with a confidence score of 85. During the first week, analysts notice that 40% of the IP addresses in the feed are sinkholed by the vendor but still resolve to live infrastructure in your environment. You need to configure your SIEM to ingest these indicators while minimizing false positives from sinkholed addresses. What should you do first?

You are configuring a firewall to block domains identified by your TI platform. What is the primary risk of using 'automated blocking' without human verification?

Which hunting methodology involves starting with a known adversary tactic and working backward to identify evidence in your logs?

Which TWO of the following are common challenges when sharing intelligence between organizations?

Which TWO of the following are recognized categories of threat intelligence sources?

A retail company's SOC manager wants to shift from reactive alert triage to a proactive posture. The CISO has approved budget for a program that will produce finished assessments about which adversaries are most likely to target the company's new contactless payment platform, why they would do so, and what business impact an intrusion would create. Which type of intelligence best matches this deliverable?

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

Which regulatory framework should a company consider when sharing threat intelligence that contains PII (Personally Identifiable Information) with international partners?

You are an intelligence analyst preparing a report on a new malware variant. You have obtained technical details from a trusted partner under TLP:AMBER. You need to include these details in an internal report for your organization's incident response team. Which of the following is the most appropriate way to handle the TLP:AMBER information in your internal report?

An analyst is using YARA to create a rule that detects a specific malware family by matching a unique string in memory. The analyst wants the rule to match when the string appears at least three times in the scanned data. Which YARA condition should the analyst use?

A SOC analyst is building a risk-based alert prioritization model in their SIEM. They want to enrich incoming alerts with threat intelligence that reflects the organization's specific business context. Which TWO data sources should be integrated into the risk scoring to achieve this? (Choose two.)

You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?

During the requirements planning phase, a CTI analyst categorizes intelligence needs based on consumer levels. Which THREE types of intelligence consumers must be addressed in a comprehensive intelligence plan? (Choose THREE)

A threat intelligence analyst is reviewing a report on a ransomware group that has targeted multiple hospitals. The report states the group uses the 'double extortion' model. Which of the following best describes this tactic?

A threat hunter is examining network flow data to detect potential lateral movement using the SMB protocol. The hunter notices a series of connections from a single workstation to multiple servers on port 445, each followed by a short-lived session. Which analysis technique would best help identify this as malicious lateral movement?

A threat hunter wants to detect adversaries abusing the Windows Management Instrumentation command-line utility to execute code on remote hosts during a hunt for lateral movement. Which artifact should the hunter prioritize to identify the remote execution attempt on the target machine?

During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?

Your organization uses a commercial TI platform that ingests multiple feeds. During an incident review, you notice that one feed consistently produces indicators that later turn out to be benign cloud provider IP ranges. What is the most appropriate corrective action to improve the intelligence program?

You are a threat intelligence analyst and have just finished writing a report on a new malware campaign. Before disseminating it, you need to ensure the report meets the criteria for actionable intelligence. Which of the following best describes actionable intelligence?

You are implementing a TIP and want to prioritize intelligence based on the source's reputation. Where should you configure this logic?

You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?

You are selecting a format for sharing intelligence with a heterogeneous group of partners. Which THREE of the following are benefits of choosing STIX/TAXII over unstructured CSV/PDF reporting?

You are reviewing a threat intelligence report that includes an indicator of compromise (IoC) in the form of a file hash. The report states that the hash is 'SHA-256: 8f14e45fceea167a5a36dedd4bea2543...'. What is the primary purpose of including this hash in the report?

Which THREE of the following are considered challenges when ingesting threat intelligence feeds?

You are configuring a TAXII 2.1 client to consume feeds from an industry ISAC. You have successfully authenticated but are receiving empty response bodies for your collections. Which configuration setting should you verify in the TAXII client to ensure you are polling the correct resource path?

You are troubleshooting an issue where a SIEM cannot parse an incoming STIX 2.1 bundle. The bundle contains a 'Relationship' object linking a 'Malware' object to an 'Infrastructure' object. Which property within the 'Relationship' object must be verified to ensure the link type is recognized by the parser?

A CTI team is developing its intelligence requirements for the upcoming year. The team lead wants to ensure that the requirements are structured to support both tactical and strategic decision-making. Which of the following best describes the primary purpose of defining Priority Intelligence Requirements (PIRs)?

When planning a Threat Intelligence program budget, an organization must account for various resource categories. Which THREE resource categories should be included in the CTI program budget plan? (Choose THREE)

In the context of STIX 2.1, what is the purpose of the 'relationship' object?

You are a CTI analyst preparing a strategic intelligence report for your organization's executive committee. The report assesses a nation-state threat group's long-term intentions and capabilities. Which two actions are most appropriate to ensure the report effectively supports executive decision-making? (Choose two.)

A threat intelligence analyst is integrating a new external feed into the organization's SIEM. The feed provides indicators with varying confidence levels. The analyst must ensure that only high-confidence indicators trigger automated alerts to reduce false positives. Which component of the intelligence lifecycle is most directly involved in this filtering process?

Which TWO of the following are benefits of using a Threat Intelligence Platform (TIP)? (Choose two)

A threat intelligence analyst is assigned to establish a collection plan for a new business unit that has just expanded its operations to the cloud. The analyst needs to determine the most effective source to gather information about threat actors specifically targeting cloud service providers and their attack techniques. Which of the following sources should the analyst prioritize?

A telecommunications provider's CTI team is preparing to share finished intelligence with a trusted industry ISAC. The team must decide what to include and how to protect sensitive content. Which two practices are appropriate for sharing intelligence in this context? (Choose two.)

You are a threat intelligence analyst at a financial services firm. After a recent intrusion, you need to produce a report for the board of directors that explains the likely threat actor, their motivation, and potential business impact. Which reporting format is most appropriate for this audience?

In the context of data analysis for CTI, what is the primary purpose of normalizing disparate log data from multiple SIEM sources?

Your management team requires a high-level summary of the threat landscape to inform budget allocation. Which type of threat intelligence report should you provide?

You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?

Which TWO methods are effective for visualizing threat actor TTPs within a CTI report?

A threat intelligence report uses the Diamond Model for Intrusion Analysis. You are adding a new 'Victim' node. What information should you include to align with this model?

You are assessing a threat actor's 'Capability'. Which of the following would be considered a CTI Capability indicator?

A threat hunter is examining Sysmon telemetry on a workstation and sees an svchost.exe process whose image path is C:\Users\Public\svchost.exe, whose parent is explorer.exe, and which has an unsigned binary with no version information. Which hunting assessment is most appropriate?

You are a threat intelligence analyst supporting a SOC. The SOC uses a SIEM that ingests indicators from multiple feeds. You notice that a high-priority indicator from a trusted feed is not generating alerts. After investigation, you find the indicator is an IPv6 address, but the SIEM's ingestion parser only supports IPv4. What is the most appropriate action to improve the intelligence program?

A junior analyst presents a chart showing that malware detections in your environment dropped 40 percent after a new endpoint agent was deployed. You suspect the chart is misleading because the agent only covers Windows servers, while the previous agent covered servers and workstations. Which analytic step should you take FIRST to validate whether the apparent drop is real?

Which TWO of the following are valid ways to improve the reliability of threat intelligence data?

Which THREE actions should a SOC team perform when a high-confidence indicator is received via a threat intelligence feed?

A threat hunter is reviewing Sysmon logs to detect potential credential dumping via LSASS memory access. Which Sysmon Event ID should the hunter prioritize to identify suspicious access to the lsass.exe process?

A junior analyst at a managed security services provider receives a feed of IP addresses and file hashes from a vendor and is told to push them to the firewall and endpoint platform for automatic blocking. What type of threat intelligence is the analyst handling?

You are the CTI lead at a hospital network. Your SOC receives a vendor report stating that a ransomware group is actively targeting healthcare providers in your region with a new encryptor. Your CISO asks what the FIRST action should be to convert this intelligence into operational value for the SOC. What do you do?

During the direction phase of the intelligence cycle, a CTI analyst receives a request from the Chief Information Security Officer (CISO) for intelligence on a specific threat actor group that has been targeting the organization's industry. The analyst must translate this request into a formal intelligence requirement. Which of the following is the most appropriate first step?

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Which TWO aspects of a threat intelligence report are most useful for long-term strategic risk management decisions?

An analyst is enriching indicators of compromise before publishing them for detection engineering. Which action best reflects sound intelligence preparation for an IP address indicator?

Which THREE of the following are valid Traffic Light Protocol (TLP) labels?

An organization is establishing metrics for its Threat Intelligence program review. The CTI director wants to measure 'Collection Efficiency.' Which formula or evaluation method best represents this metric?

A threat intelligence analyst is studying a sophisticated APT group that has been observed using a previously unknown backdoor. The analyst wants to create a detection rule that focuses on the adversary's operational behavior rather than static indicators. Which of the following best describes the type of detection logic the analyst should prioritize?

A threat intelligence analyst is examining a malware sample that uses a domain generation algorithm (DGA) to create a large number of pseudo-random domain names. The malware queries these domains to locate its command-and-control (C2) server. Which of the following best describes the primary purpose of using a DGA in this context?

A newly formed CTI team is defining the requirements for its intelligence program. The team lead wants to ensure the program produces intelligence that is both actionable and aligned with business risk. Which TWO characteristics should the program prioritize? (Choose two.)

Which TWO of the following are common methods used to normalize threat data from disparate sources?

Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?

An analyst receives a collection of threat indicators from a partner in a STIX 2.1 bundle. Several indicators use the 'pattern' property with the 'LIKE' comparison operator, such as [file:name LIKE '%.exe']. The analyst needs to filter these indicators to only those that match files with a specific name exactly 'malware.exe'. Which STIX pattern should the analyst use to achieve this?

A threat hunter is investigating a suspected data exfiltration over HTTPS. The hunter has full network traffic capture and wants to identify potential exfiltration channels. Which two characteristics are most indicative of malicious exfiltration over HTTPS? (Choose two.)

You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?

Which TWO of the following are common actions performed during the 'processing' phase of the threat intelligence lifecycle?

During a threat intelligence analysis, you are examining a large dataset of network flow records. You notice a significant number of outbound connections from internal hosts to a known malicious IP address on port 443, but the connections are short-lived and occur at regular intervals. Which of the following best describes the adversary behavior you are observing?

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

Which of the following is a primary benefit of using a 'Diamond Model' of intrusion analysis in your threat report?

A healthcare provider's CTI team is building its first intelligence program. The CISO asks the analysts to define the intelligence requirements before purchasing any feeds or tools. The analysts want to ensure the requirements are written in a way that will actually drive collection and production. Which approach best satisfies this goal?

Which THREE of the following are security best practices for managing a TAXII server?

An intelligence manager is reviewing the threat intelligence program's intelligence gap analysis. The analysis reveals that the team frequently fails to detect supply chain intrusions until late in the attack lifecycle. Which adjustments to the direction and planning phase should the manager implement?

You are a CTI analyst preparing to share a report with a partner organization. The report contains sensitive technical details about an ongoing investigation. You want to ensure the information is shared only with the intended recipients and that they understand the handling restrictions. Which action best fulfills this requirement?

An intelligence manager is evaluating sources for a threat intelligence program during the planning phase. Which TWO criteria are critical when vetting a new external threat intelligence vendor or feed? (Choose TWO)

You are hunting for Cobalt Strike C2 using JA3/JA3S fingerprinting. If the JA3S value is unique for your environment and observed across multiple hosts, what does this suggest?

A CTI analyst is tasked with reviewing the effectiveness of the intelligence program. The analyst notices that despite having clear PIRs, the intelligence reports often fail to answer the specific questions posed by decision-makers. Which of the following should the analyst evaluate FIRST to identify the root cause?

A CTI manager is developing a collection plan to support a new intelligence requirement on supply chain attacks targeting the organization’s software vendors. The manager needs to identify the types of intelligence sources that should be included. Which THREE of the following are appropriate sources for this collection plan? (Choose three.)

You are configuring a TAXII client to pull STIX 2.1 data from a commercial threat intelligence platform. During testing, the client reports a 406 Not Acceptable error. What is the most likely cause?

An analyst receives a report from a sharing partner containing indicators of compromise for a campaign against the energy sector. Before including these indicators in the organization's blocklists, the analyst must assess the source's reliability and the information's credibility. The partner has been accurate in past reporting but this specific report contains indicators that conflict with the organization's own telemetry. Which principle should guide the analyst's handling of this conflict?

An energy utility's CTI analyst is asked to classify a collection source for an intelligence assessment. The source is a closed forum where criminal actors discuss operational security and sell access to corporate networks. The analyst must assign the correct source category and describe the handling caveat that applies. Which classification and caveat are most appropriate?

An organization is conducting a review of its threat intelligence program to assess alignment with intelligence-driven defense models. Which TWO frameworks are widely used to structure threat intelligence planning, collection, and defense operations? (Choose TWO)

A newly hired SOC analyst is asked to explain the fundamental difference between data, information, and intelligence to a group of interns. The analyst wants to describe what specifically distinguishes finished threat intelligence from raw collected data. Which statement best describes this distinction?

A threat intelligence analyst is preparing to analyze a large set of intrusion artifacts collected from multiple sensors. She wants to apply structured analysis techniques to reduce bias and improve the defensibility of her conclusions. Which two techniques are most appropriate for this goal? (Choose two.)

An analyst is mapping internal incident data to STIX 2.1 objects. You need to link a specific threat actor to the infrastructure they recently utilized. Which object type should you use to link the 'Threat-Actor' object to the 'Infrastructure' object?

You are managing threat intelligence in a cloud-native environment. You need to identify indicators related to unauthorized API key usage in AWS. Which AWS service provides the most relevant CTI data for this investigation?

A retail company's threat intelligence team is asked by the board to explain how the team's work reduces business risk. The analysts want to describe the primary purpose of threat intelligence within an organization. Which statement best captures that purpose?

You are reviewing your organization's threat modeling process. Which TWO of the following are considered essential components to include when documenting a threat model?

Which THREE data sources are typically analyzed when investigating an insider threat according to security behavior analytics?

In an ACH matrix, you have assigned values to the diagnostic evidence. You observe that a specific hypothesis has the lowest score. What does this indicate about the hypothesis?

A CTI analyst is defining Intelligence Requirements (IRs) for a new threat intelligence program. The CISO asks the analyst to ensure that the IRs are both actionable and aligned with the organization's risk appetite. Which of the following is the MOST appropriate first step in this process?

You are setting up a STIX-to-SIEM pipeline. The SIEM requires data in CSV format. What is the critical step in your data processing architecture?

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

You are a threat intelligence analyst at a healthcare organization. Your team is developing a threat model for a new telemedicine platform. You need to identify potential threat actors and their capabilities. Which two of the following factors are most critical to consider when assessing threat actor intent and capability? (Choose two.)

Which of the following is an example of 'structured' threat intelligence data?

A threat intelligence analyst is mapping adversary tactics to the MITRE ATT&CK framework. The analyst observes that an adversary is using scheduled tasks and Windows services to maintain persistence on compromised hosts. Which two ATT&CK techniques are being used? (Choose two.)

A SOC analyst receives a threat intelligence report indicating that a specific APT group is targeting the organization's industry with a new malware family that uses DNS tunneling for command and control. The analyst wants to create a detection rule in the SIEM to identify this activity. Which data source and detection logic would be most effective?

Which TWO log sources are most essential when hunting for adversary use of living-off-the-land binaries (LotL)?

During a threat hunt for Kerberoasting, an analyst reviews Windows Security event logs and notices Event ID 4769 (Kerberos service ticket request) entries with RC4 encryption (0x17) for multiple service principal names from a single user account within a short window. Which additional context is most important to confirm malicious intent rather than benign service access?

An intelligence analyst is tasked with tailoring intelligence requirements for a merger and acquisition (M&A) scenario. Which methodology should be applied during the direction phase to identify threat actors specifically interested in compromising corporate transactions?

While hunting for living-off-the-land (LotL) binaries, you identify suspicious use of 'certutil.exe'. What is the most likely malicious purpose for this utility?

What does a high 'CVSS' score indicate in the context of vulnerability data analysis?

An analyst receives a raw log export from a partner organization containing firewall records, proxy logs, and endpoint telemetry related to a suspected intrusion. Before any conclusions can be drawn, the analyst normalizes timestamps to UTC, deduplicates records, decodes obfuscated URLs, and translates the field names into the team's common schema. Which phase of the threat intelligence lifecycle is the analyst performing?

During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?

In the threat intelligence lifecycle, what is the 'Dissemination' phase primarily concerned with?

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

In a threat intelligence lifecycle, what is the specific role of the 'Dissemination' phase in relation to the IR team?

Which THREE of the following are primary components (vertices) of the Diamond Model of Intrusion Analysis?

You are a threat intelligence analyst at a financial institution. Your team is preparing to share a report on a recent ransomware campaign with a trusted partner via a TAXII 2.1 collection. To ensure the report is correctly interpreted and the sharing complies with internal policies, which two actions must you take before dissemination? (Choose two.)

You are analyzing a Linux server that is suspected of being compromised. You observe a process named 'kworker' that is consuming high CPU, but when you check the parent process ID (PPID), it is 1 (init). Which of the following is the most likely explanation for this observation?

You are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?

During a peer review, an analyst is challenged on a finished intelligence assessment that states with high confidence that a specific actor is responsible for an intrusion. The analyst's evidence consists of a single reused malware sample hash and a shared hosting provider. Which criticism is most valid under sound analytic standards?

A threat hunter is analyzing Windows event logs to detect an adversary using scheduled tasks for persistence. The hunter wants to identify tasks created with a hidden setting. Which event ID and field should the hunter focus on?

A threat intelligence analyst is collecting data from a new OSINT source that provides indicators in a proprietary XML format. The analyst needs to extract the indicators and convert them into a structured format for ingestion into the organization's TIP. Which of the following is the most appropriate first step in processing this data?

You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?

Which TWO file integrity monitoring (FIM) events would be most useful to detect potential unauthorized persistence mechanisms?

When collecting data from open-source intelligence (OSINT) sources, what is the primary risk associated with automated scraping without rate-limit awareness?

A CTI manager is conducting a review of the intelligence requirements after a major merger. The organization's priorities have shifted, and the manager must ensure that the collection efforts remain aligned with the new business objectives. Which of the following actions best ensures that the intelligence requirements continue to meet the evolving needs?

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

A SOC analyst is building a hypothesis set to explain a suspected data exfiltration event. She creates five mutually exclusive hypotheses and then scores each piece of evidence for consistency with every hypothesis. After scoring, she notices that one hypothesis has the highest total consistency score, but the evidence is sparse and several items are ambiguous. What should she do before finalizing her assessment?

When disseminating intelligence to C-level executives versus technical SOC analysts, you must adjust your reporting format. Which technique ensures compliance with intelligence cycle requirements for 'Actionable Intelligence'?

A CTI manager is reviewing the intelligence requirements after a major business acquisition expanded the organization's presence into new regions. The manager must adjust the requirements to address new risks. Which TWO of the following actions are most appropriate during this review? (Choose two.)

Which THREE types of information should be collected during the 'Processing' phase of the intelligence cycle to ensure data quality?

A threat intelligence analyst is processing a large dataset of indicators collected from multiple OSINT sources. The analyst notices that many indicators are malformed, such as IP addresses with invalid octets or domain names containing illegal characters. The analyst needs to ensure that only valid indicators are stored in the intelligence platform. Which action should the analyst take during the processing phase?

A threat hunter is investigating a suspected Kerberoasting attack. Which Windows event ID should the hunter analyze to identify service tickets being requested for accounts with Service Principal Names (SPNs)?

While conducting a threat modeling exercise using STRIDE, you are analyzing a cloud-based API gateway. You notice that authentication tokens are being logged in plain text in the debugging logs. Which threat category in STRIDE is most specifically violated here?

Which of the following is a primary 'push' source for threat intelligence in an enterprise SOC?

Which TWO types of intelligence are primarily categorized as 'Tactical' in nature?

You are the lead CTI analyst at a financial services firm. After a recent breach, you must deliver a threat intelligence report to the board of directors. The board has limited technical background but needs to understand the business impact and make risk-based decisions. Which reporting approach is most appropriate for this audience?

When preparing a report for a SOC team, which metric is most important to include to prove the intelligence is actionable?

You are a CTI analyst at a multinational corporation. You have produced a strategic intelligence report assessing the long-term threat posed by a nation-state actor targeting your industry. The report includes sensitive details about your organization's defensive posture. You need to share it with your subsidiary in a foreign country. Which TLP marking should you apply to ensure the information is shared appropriately while protecting your organization's interests?

An organization wants to contribute intelligence to an ISAC (Information Sharing and Analysis Center). They need to ensure their sharing mechanism supports automated, near-real-time updates. Which standard should they adopt?

During the threat landscape analysis and requirements gathering process, an organization must identify its critical assets and crown jewels. Which THREE categories represent typical critical assets that should drive intelligence requirements? (Choose THREE)

Which THREE factors should be considered when evaluating the reliability of a threat intelligence vendor? (Choose three)

During an incident response engagement, a threat intelligence analyst observes that the adversary used a compromised employee's VPN credentials to access the corporate network, and then moved laterally to other systems using legitimate administrative tools. The analyst wants to map these actions to the MITRE ATT&CK framework. Which tactic best describes the initial use of valid VPN credentials?

A threat intelligence analyst is studying an advanced persistent threat (APT) group that has been observed using a novel technique to maintain persistence. The group modifies the Windows Registry to add a malicious DLL to the AppInit_DLLs key, which loads the DLL into every process that loads User32.dll. Which MITRE ATT&CK technique is this an example of?

An analyst is preparing a threat intelligence report that includes a new malware family's capabilities and infrastructure. The report is intended for a closed group of trusted partners under TLP:AMBER. Which of the following is the most critical element to include to ensure the report is both actionable and compliant?

A government agency's CTI team produces a finished intelligence product for policymakers. The team wants to apply structured analytic techniques to reduce cognitive bias and communicate uncertainty clearly. Which practice best supports this objective?

A newly formed CTI team is conducting stakeholder interviews to establish intelligence requirements. The Chief Risk Officer (CRO) expresses concern over ransomware supply chain disruptions. How should the intelligence analyst translate this concern into a formal intelligence requirement?

A threat intelligence analyst is collecting data from a TAXII 2.1 server. The analyst needs to retrieve only the indicators that have been added or modified since the last collection. Which TAXII 2.1 feature should be used to achieve this?

A SOC analyst receives a threat intelligence report indicating that a new phishing campaign is targeting your industry with a specific malicious domain. The analyst wants to quickly check if any internal hosts have communicated with that domain. Which action should the analyst take first?

A threat intelligence analyst is supporting an incident response team during an active ransomware outbreak. The IR team needs to know if the ransomware strain has been observed using a specific lateral movement technique. Which action should the analyst take to provide the most actionable intelligence?

A threat intelligence analyst is tasked with creating a risk assessment for a new ransomware variant that has been observed targeting the organization's industry. The analyst has technical indicators, TTPs, and strategic reports from an ISAC. To effectively communicate the risk to the executive team, which component should the analyst emphasize?

A security operations center analyst is mapping an intrusion to the MITRE ATT&CK framework. The analyst observes that after gaining initial access, the adversary used Windows Management Instrumentation (WMI) to remotely create processes on other hosts in the domain. Under which ATT&CK tactic does this activity fall?

During the planning phase of building a CTI team, the program manager needs to define the scope of intelligence operations. Which category of intelligence focuses specifically on technical indicators such as file hashes, IP addresses, and domain names?

Which TWO components are mandatory for a valid STIX 2.1 'Indicator' object to function within an automated ingestion system?

When conducting a 'Sensitivity Analysis' on your threat model, what are you attempting to determine?

A threat intelligence analyst is investigating a malware sample that communicates with a command-and-control (C2) server using a custom protocol over TCP port 443. The traffic is encrypted and does not match typical TLS patterns. The analyst observes that the malware sends a small beacon every 60 seconds, and the server responds with a similarly sized packet. Which analysis approach would BEST help the analyst understand the C2 protocol and extract potential indicators?

You are reviewing a threat intelligence report that includes a list of indicators. You notice that one indicator is an IP address with a low confidence score. According to best practices, what should you do before using this indicator for detection?

You are a CTI analyst at a healthcare provider. After producing a tactical report on a ransomware campaign, you must disseminate it to internal SOC analysts and external partners. The report contains a mix of strategic assessments and technical indicators. Which dissemination method best balances timeliness, security, and audience needs?

During program planning for a CTI team, the program manager must define stakeholder engagement protocols. Which THREE stakeholder groups should be actively engaged during the requirements planning and review phases? (Choose THREE)

A threat intelligence analyst is examining a malware sample that uses a technique to hide its presence by injecting code into a legitimate process. The analyst observes that the malware creates a new process in a suspended state, unmaps its memory, and replaces it with malicious code. Which technique is being used?

Which of the following is a 'pull-based' method of threat intelligence data collection?

You are ingesting threat data into a TIP and notice that indicators lack 'TLP' (Traffic Light Protocol) markings. What is the standard industry procedure?

You are troubleshooting a synchronization issue between two threat intelligence platforms. One platform is configured for TAXII 2.1 and the other is receiving the data but failing to parse the STIX 2.1 bundle. Which diagnostic step is most appropriate?

A manufacturing firm's CTI analyst receives a report describing a new malware loader used by a financially motivated group. The report lists file hashes but no context on targeting or exploitation. The analyst must decide how to classify and route this intelligence internally. Which action best reflects sound intelligence practice?

A CTI analyst is tasked with developing a collection plan to support the organization's intelligence requirements. The analyst must prioritize sources based on reliability, relevance, and cost. Which of the following criteria should be the PRIMARY consideration when selecting sources?

You are analyzing a malware sample that communicates with a command-and-control (C2) server. The network traffic shows periodic HTTP GET requests to a domain that resolves to multiple IP addresses, and the User-Agent string is identical across all requests. Which of the following analytical techniques would best help you identify the infrastructure and potential attribution of the threat actor?

You are analyzing an intelligence report provided in STIX 2.1 format. You find an 'Identity' object being used to attribute the campaign. What is the most common use of the 'Identity' object in this context?

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

During an active ransomware incident, your SOC manager asks you to quickly determine whether the malware family has known lateral movement capabilities against Windows environments. Which threat intelligence product best supports this immediate need?

A threat intelligence analyst is tasked with enriching indicators of compromise (IOCs) from a recent malware campaign. The analyst has a list of file hashes and wants to gather additional context to support incident response. Which TWO of the following actions would BEST provide actionable intelligence about the malware's capabilities and infrastructure? (Choose two.)

A threat intelligence analyst is reviewing an incident where the adversary used a previously unseen malware family and a novel exploit. The analyst wants to map the adversary's behavior to the MITRE ATT&CK framework. Which of the following best describes the appropriate level of abstraction to use?

You are a CTI analyst tasked with creating a threat intelligence report for your organization's security operations center (SOC). The SOC team needs to quickly detect and respond to a newly identified adversary campaign. Which two elements are most critical to include in this report? (Choose two.)

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

During a malware analysis engagement, you receive a sample whose import table references the Windows API functions VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. Which analytical conclusion is best supported by this evidence?

A threat intelligence analyst is reviewing a report that describes an adversary using the 'Pyramid of Pain' model. The analyst wants to prioritize defensive actions based on the model. Which of the following indicators would cause the most pain to the adversary if blocked?

A hunter is investigating anomalous DNS activity on an internal resolver. Several endpoints are issuing high volumes of queries for long, random-looking subdomains under a single registered domain, with responses that are mostly NXDOMAIN but occasionally resolve. Which TWO detection approaches would most effectively confirm whether this is DNS tunneling or domain generation algorithm activity? (Choose two.)

A hunter is reviewing Zeek conn.log and notices long-lived, low-volume TLS sessions from several internal workstations to the same external IP on port 443 where the server certificate is self-signed, the JA3S value is identical across all sessions, and the byte counts are almost symmetric over hours. The workstations show no matching DNS queries for that IP and no proxy logs because the traffic bypasses the proxy. Which hypothesis best fits this evidence?

An analyst is investigating potential persistence via WMI event subscriptions. Which WMI namespace should the hunter focus on for suspicious event consumers?

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

When deduplicating threat intelligence data, which unique identifier is most effective for comparing two different 'malware' objects?

A security operations center (SOC) receives an alert about a workstation exhibiting unusual outbound traffic to a known malicious IP address. The analyst suspects the workstation is compromised and communicating with a command-and-control (C2) server. According to the Cyber Kill Chain, which phase does this activity represent?

An analyst is reviewing a threat intelligence report that includes a list of IP addresses, domain names, and file hashes associated with a recent campaign. The report states that these indicators were observed on multiple victim networks over the past month. What is the most appropriate first step before using these indicators in detection rules?

A threat hunter reviewing Windows Security event logs notices that a service account's credentials were used to authenticate to 14 workstations within a 3-minute window, all successful logons with Logon Type 3. No scheduled tasks or administrative scripts are known to run under this account. Which hypothesis best explains this pattern and should drive the next hunt step?

When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?

Your SOC is building a threat intelligence program and the CISO asks which outputs should be delivered to the risk management team to support enterprise risk decisions. (Choose two.)

You have received a raw feed of IP addresses. Before putting these into your firewall, you perform 'vetting'. What is the primary purpose of this vetting step?

A newly formed threat intelligence team is drafting its charter and must document the phases of the threat intelligence lifecycle it will follow, along with the feedback loop that closes the process. Which THREE of the following are recognized phases of that lifecycle? (Choose three.)

A threat hunter is investigating possible data staging prior to exfiltration on a file server. The hunter has full Windows Security auditing, Sysmon, and PowerShell logging available. Which TWO telemetry patterns most directly indicate that an adversary is staging and compressing collected data on the host? (Choose two.)

A threat hunter is reviewing DNS logs to detect potential domain generation algorithm (DGA) activity. Which characteristic is most indicative of a DGA-generated domain?

A security analyst is mapping adversary behavior to the MITRE ATT&CK framework. The analyst observes that the adversary is using the 'Spearphishing Attachment' technique. Under which ATT&CK tactic does this technique fall?

When hunting for lateral movement, which THREE activities should be flagged as highly suspicious in a Windows environment?

An analyst is building a threat actor profile and wants to classify the group according to its primary motivation. The group consistently steals customer payment records and immediately monetizes them through underground carding forums, with no apparent political or espionage objective. Under the common CTI motivation categories, how should this group be classified?

Which THREE indicators are strong evidence of a 'Pass-the-Hash' attack occurring in your network?

Which of the following best describes an Advanced Persistent Threat (APT)?

A threat intelligence team is correlating indicators from multiple feeds. They observe that a set of domain names resolves to fast-flux IP addresses, the domains were registered within the last 48 hours, and the same SSL certificate serial number appears across several unrelated domains. Which analytic conclusion is best supported by this evidence?

A threat intelligence analyst is studying an advanced persistent threat (APT) group that has been observed using a technique called 'domain fronting' to evade detection. Which of the following best describes how domain fronting works?

A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?

Which TWO of the following are necessary to include when creating a high-quality threat intelligence report for an operational team?

A security analyst is reviewing threat intelligence reports and notices that an APT group frequently uses zero-day exploits and custom malware to target government agencies. The group maintains long-term access to victim networks and exfiltrates sensitive data over extended periods. Which characteristic best distinguishes this group as an Advanced Persistent Threat (APT)?

When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?

When normalizing threat data using the STIX 2.1 standard, which field must be populated to define the 'type' of the observable for a file object?

While using ELK Stack for threat hunting, you need to identify beaconing behavior. Which aggregation function would best reveal periodicity in connection intervals?

You are building a link analysis chart to map an intrusion set's operational infrastructure. You have collected domain registrations, malware sample hashes, and command-and-control IP addresses, but you need to select additional data elements that will produce meaningful links rather than coincidental ones. (Choose two.)

In Microsoft Sentinel, you are tasked with creating a hunting query to detect 'Living off the Land' techniques. Which KQL operator allows you to join TI indicator data with device logs?

You are a CTI analyst tasked with disseminating a finished intelligence report to a non-English-speaking partner. The report contains technical indicators and strategic assessments. Which dissemination consideration is most critical to ensure the partner can effectively use the intelligence?

An analyst is extracting indicators from a large collection of PDF reports. The reports contain IP addresses embedded in narrative text, tables, and footnotes with inconsistent formatting. The analyst needs a repeatable method to extract IPv4 addresses while minimizing false positives from version numbers such as 10.2.3.4. Which approach best supports this requirement?

You are mapping a threat report to the MITRE ATT&CK framework. You have identified that the attacker uses 'PowerShell' to execute commands. Which category should this be mapped to?

You are disseminating a report. You want to ensure that the recipients understand the sensitivity of the information. What is the most effective way to communicate this standard?

You are reviewing network traffic logs for potential C2 (Command and Control) beaconing. You decide to use a rolling average to smooth out the data. Why is this statistical technique useful in this scenario?

An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?

A threat intelligence analyst is examining a malware sample and notices that the executable's import table contains only two functions from kernel32.dll: LoadLibraryA and GetProcAddress. The analyst suspects the sample is designed to evade static analysis. Which technique is MOST likely being used?

A financial services firm has subscribed to three commercial threat feeds. Analysts notice that one feed consistently publishes indicators for the same campaigns as the other two but always several hours later, while a second feed publishes unique indicators that are never corroborated elsewhere. The intelligence lead wants to document these behavioral characteristics formally so consumers understand how much weight to give each feed. Which concept is the lead describing?

A SOC analyst is triaging a suspected intrusion and receives a threat intelligence report that contains a list of adversary tactics, techniques, and procedures (TTPs) from a known APT group. The analyst wants to map these TTPs to the MITRE ATT&CK framework to identify gaps in detection coverage. Which type of threat intelligence is the analyst primarily using?

A threat intelligence team is analyzing an adversary's use of the Diamond Model to document an intrusion. The team wants to identify which elements constitute the 'Infrastructure' axis of the Diamond Model. (Choose two.)

An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)

You are a CTI analyst preparing to disseminate a report that includes indicators attributed to a specific nation-state actor. Your organization's legal team advises that sharing these indicators could reveal sensitive sources and methods. Which dissemination strategy best balances the need to inform stakeholders with the need to protect sources?

Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?

A threat intelligence analyst is processing a new feed that contains indicators of compromise (IOCs) in STIX 2.1 format. Before ingesting the data into the internal platform, the analyst must validate that the STIX objects conform to the specification. Which two of the following are required properties for a STIX 2.1 'Indicator' object? (Choose two.)

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

A SOC manager is defining the intelligence requirements for the incident response team. The team wants to receive threat intelligence that helps them quickly determine the scope of a potential breach. Which type of intelligence best supports this need?

Your organization's SOC is drowning in alerts, and the CISO wants to reduce noise using threat intelligence. Which approach best applies TI to prioritize alerts during triage?

A CISO asks for a report that provides a strategic outlook on the threat landscape for the upcoming quarter. What format is most appropriate for this type of audience?

A threat intelligence analyst is integrating a new feed into the SOC's SIEM. The feed provides indicators with a confidence score of 75. The analyst notices that some indicators are six months old and have not been observed recently. According to best practices for threat intelligence in SOC operations, what should the analyst do first to ensure effective alerting?

When conducting an Analysis of Competing Hypotheses (ACH), which TWO actions help mitigate cognitive bias in your conclusions?

A junior analyst asks how to choose between competing hypotheses about an intrusion. Which approach best reflects structured analytic technique?

A threat intelligence analyst is asked to support the incident response team during an active investigation of a suspected compromise. The IR team needs to know whether the observed IP address 203.0.113.45 is associated with any known threat actor. Which action should the analyst take first?

A CTI manager is reviewing the team's Priority Intelligence Requirements (PIRs) and notices that they are too broad, making it difficult to focus collection efforts. Which action should the manager take to improve the PIRs?

When preparing a STIX 2.1 bundle for sharing via TAXII, which THREE of the following fields are strictly required for an 'Indicator' SDO to be considered 'well-formed'?

You are integrating a new Threat Intelligence Platform (TIP) into your SIEM. The TIP supports the OpenIOC format. What is the primary advantage of using OpenIOC over simple CSV lists?

When setting up a TAXII 2.1 Collection in a commercial TIP, you are asked to provide a 'Collection ID'. What is the primary purpose of this identifier?

A SOC manager is reviewing the incident response process and wants to ensure that threat intelligence is effectively used during an active incident. The manager asks the analyst to provide intelligence that will help the team understand the adversary's likely next steps and prioritize containment efforts. Which type of threat intelligence should the analyst prioritize?

During an active incident, your IR team needs to know whether a specific IP address is a known C2 node. Your TI platform returns a confidence score of 95 with a first-seen date of 14 months ago. What is the most appropriate way to use this intelligence in the IR decision-making process?

You are analyzing an adversary's 'Infrastructure'. You note that they rotate IP addresses every 24 hours. Which analysis technique is most effective for mapping this persistent behavior?

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

A threat hunter is investigating a suspected data exfiltration channel that uses DNS tunneling. The organization's DNS logs capture query names, query types, response codes, and source hosts, but not full packet payloads. Which TWO characteristics of the DNS queries would most reliably indicate tunneling activity rather than normal DNS behavior? (Choose two.)

You are integrating a new threat intel feed that provides 'Course of Action' (CoA) objects. What is the intended use of this STIX object type in an automated environment?

An analyst at a financial services firm receives a threat feed where each entry contains a 'confidence' field set to 85. The feed vendor's documentation states that confidence values are expressed as a percentage. The analyst needs to normalize this data before loading it into the internal threat intelligence platform, which accepts confidence on a 0-100 integer scale. Which action should the analyst take during processing?

A threat hunter is reviewing DNS query logs from a corporate recursive resolver to identify hosts that may be beaconing to a domain generation algorithm (DGA) family. The hunter notices that one workstation generates many queries for short, random-looking domains that all fail with NXDOMAIN, while another workstation generates far fewer queries but with a consistent subdomain string appended to a long-lived domain. Which observation most strongly indicates an active DGA-based beacon rather than normal application behavior?

A CTI team is developing a collection plan for a new intelligence requirement focused on ransomware groups targeting the healthcare sector. The team must select the most relevant sources to gather information on these groups' tactics, techniques, and procedures (TTPs). Which of the following sources would provide the most direct and actionable intelligence for this requirement?

Which THREE factors should be considered when evaluating the reliability of threat intelligence data used in your analysis?

A financial institution's threat intelligence team is evaluating a new commercial feed. The team needs to determine if the feed provides 'actionable' intelligence. Which characteristic of the feed is most critical to this determination?

An analyst is using the MITRE ATT&CK framework to categorize adversary behaviors observed during an incident. The analyst notes that the attacker used a scheduled task to maintain access and also encrypted files on a file share to disrupt operations. Which two ATT&CK tactics do these behaviors represent? (Choose two.)

A threat intelligence analyst at a financial institution is ingesting a high-volume STIX 2.1 feed from a commercial provider. The feed contains many duplicate and near-duplicate indicators. The analyst needs to programmatically deduplicate the data before storing it in a MISP instance. Which approach is most appropriate for identifying and removing duplicate indicators?

An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?

You are building a threat intelligence program for a SOC and must define processes for the 'Direction' phase of the intelligence lifecycle. Which two activities belong to this phase? (Choose two.)

You are conducting a threat intelligence analysis on a recent cyber espionage campaign. You have collected various data points and need to assess the credibility of the intelligence. Which two of the following factors are most critical in evaluating the reliability of the threat data? (Choose two.)

A CTI analyst is conducting the direction phase for a new intelligence requirement focused on a persistent threat group targeting the organization's financial systems. The analyst must define the Essential Elements of Information (EEI) to guide collection. Which of the following best describes the purpose of EEIs in this context?

A threat intelligence analyst is creating a weekly report for the security operations center (SOC). The report includes a list of IP addresses associated with a recent phishing campaign. The analyst wants to ensure the report is actionable and prioritized for the SOC team. Which of the following should be included to best support immediate action?

A CTI analyst is developing a collection plan to support a new intelligence requirement on ransomware targeting the healthcare sector. The analyst needs to identify the most appropriate type of collection to gather information on ransomware variants and their tactics. Which of the following collection sources is best suited for this requirement?

Which THREE of the following are critical steps when troubleshooting a failed TAXII 2.1 server connection?

An intelligence analyst is preparing a report to be shared with a partner organization under the Traffic Light Protocol (TLP). The report contains threat indicators and analysis. Which TWO of the following are required to ensure proper TLP handling and dissemination? (Choose two.)

A hunt for unusual Kerberos activity reveals an 'AS-REP Roasting' attack. What specific event indicator should the analyst look for in domain controller logs?

A threat hunter is reviewing Sysmon event logs to detect credential dumping. The hunter observes that a process opened lsass.exe with access rights 0x1410 and then created a memory dump file. Which Sysmon event ID and field combination is most directly relevant for detecting this activity?

A threat intelligence analyst is examining a malware sample and observes that the binary contains a hardcoded list of domain names that are contacted in a fixed order, with a fallback to a DGA-generated domain if the first three fail. The analyst wants to characterize the command-and-control resilience of this malware. Which statement best describes the resilience of this C2 approach?

A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?

A threat intelligence analyst is ingesting a large volume of indicators from multiple feeds into a TIP. The analyst notices that many indicators are duplicated across feeds but have slightly different metadata, such as confidence scores and timestamps. To ensure efficient processing and accurate analysis, which of the following should the analyst implement to handle these duplicates?

You are analyzing a threat actor that consistently registers look-alike domains resembling your organization's partners and sends spear-phishing emails from those domains to your finance team. According to the Diamond Model of Intrusion Analysis, how should the adversary's use of these domains be classified?

A threat hunter is examining network traffic to identify potential command-and-control (C2) communication. Which characteristic of the traffic is most indicative of a C2 channel using HTTP?

A threat intelligence analyst is collecting data from a paste site that frequently removes posts within hours. The analyst wants to preserve the content for later analysis and ensure that the original source can be verified even if the post is deleted. Which collection practice best meets these requirements?

Which THREE criteria are essential when evaluating the quality of an IOC for threat intelligence sharing?

A risk manager asks you to provide threat intelligence that helps prioritize patching efforts for a newly disclosed vulnerability in your internet-facing VPN appliance. Which type of intelligence is most relevant for this request?

When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?

You are a CTI analyst preparing a weekly intelligence summary for your organization's executive leadership. The report will include a high-level overview of the current threat landscape, key risks, and recommended strategic actions. To ensure the report is actionable and aligns with the audience's needs, which of the following should be the primary focus of the report?

Which THREE of the following are considered 'Internal' sources of threat intelligence for a SOC?

A threat intelligence analyst is preparing to ingest a new threat feed that provides indicators in STIX 2.1 format. Before ingestion, the analyst must ensure the data is properly structured and can be processed by the TIP. Which of the following are valid steps to prepare the STIX 2.1 data for ingestion? (Choose two.)

A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?

A CTI analyst is tasked with producing a threat assessment for the upcoming quarter. The analyst must decide which intelligence requirements to prioritize based on the organization's risk appetite and current threat landscape. Which of the following criteria is most important when prioritizing requirements?

A threat intelligence analyst is investigating an incident where an adversary used a spear-phishing email with a link to a malicious website. The website exploited a browser vulnerability to download and execute a payload. According to the Diamond Model of Intrusion Analysis, which axis represents the malicious website?

Which of the following is a common pitfall when performing 'Trend Analysis' on threat data?

During the CTI team building process, the manager needs to hire personnel with analytical mindsets who can avoid cognitive biases. Which cognitive bias involves favoring information that confirms pre-existing beliefs while discarding contradictory evidence?

A threat intelligence analyst is processing a large set of indicators and needs to enrich them with additional context. The analyst wants to use the MITRE ATT&CK framework to map indicators to adversary tactics, techniques, and procedures (TTPs). Which data processing step should be performed first to ensure accurate mapping?