Select Two (Multi-Select) Questions

Exfiltration

Why it fails: Exfiltration covers stealing data out of the environment, not sustaining foothold access, so it cannot be one of the three persistence-related tactics. It is tempting because exfiltration is a recognised ATT&CK tactic and often follows compromise, and it would be the right answer if the question asked which tactic covers data theft over command-and-control channels.

Reconnaissance

Why it fails: Reconnaissance is the adversary's pre-compromise information-gathering phase, occurring before any foothold exists, so it cannot sustain access on a compromised host. Persistence tactics instead cover mechanisms such as scheduled tasks, services and account creation. Reconnaissance would be the right answer if the question asked how targets are scouted before an attack.

Recommendations for strategic policy changes to the board.

Why it fails: Strategic policy recommendations are intended for executive leadership, not the SOC. The SOC requires tactical and operational intelligence to detect and respond. Including such recommendations would be irrelevant to their immediate tasks and could confuse the report's purpose. The SOC's focus is on technical defense, not organizational policy.

A detailed narrative of the adversary's geopolitical motivations.

Why it fails: While geopolitical context can be useful for strategic understanding, it is not critical for immediate SOC detection and response. The SOC needs tactical, actionable information to configure defenses and hunt for threats. Motivations do not directly help in identifying or mitigating the campaign. Thus, this is less critical for the SOC's operational needs.

A comprehensive list of all threat actors known to use similar TTPs.

Why it fails: Listing all threat actors with similar TTPs can be overwhelming and may not directly aid in detecting the specific campaign. The SOC needs focused, relevant intelligence about the current adversary. Including unrelated actors could distract from the immediate threat and dilute the report's actionable value. Specificity is key for operational response.

Review the resolver's cache hit ratio and increase the TTL on all cached records to reduce query volume.

Why it fails: Cache tuning addresses performance, not security. Tunneling and DGA queries are for unique or nonexistent names that largely bypass cache, so the hit ratio would not meaningfully change and raising TTLs does nothing to identify the malicious source. This option does not produce evidence about whether tunneling is occurring.

Search the SIEM for the registered domain across historical proxy logs and add it to a watchlist if it appears in any HTTP request.

Why it fails: A single historical appearance in proxy logs is weak evidence because many legitimate domains appear in web traffic. This approach neither measures the query characteristics nor attributes activity to a process, so it cannot distinguish tunneling from ordinary browsing and risks watchlisting benign infrastructure while missing the real signal.

Block all outbound DNS at the perimeter and force every endpoint to use DNS over HTTPS to a public resolver.

Why it fails: This changes the environment rather than detecting the activity, and moving to an external DoH resolver actually reduces visibility by encrypting queries the resolver cannot inspect. It would degrade hunting capability and could mask ongoing tunneling, so it is a containment or architecture decision, not a confirmation technique.

Repeated DNS queries from the server to a single external domain at irregular intervals with varying query types.

Why it fails: Irregular DNS queries to one external domain suggest beaconing or DNS tunneling rather than host-based staging. Staging happens before exfiltration and typically involves local file collection and archiving, which does not generate DNS traffic. This pattern is better aligned with command-and-control hunting, so selecting it here would misdirect the investigation away from the local file operations that actually evidence staging.

A high volume of failed authentication attempts against the file server from multiple internal workstations.

Why it fails: Failed authentication from multiple workstations indicates password spraying, credential stuffing, or a misconfigured service account, not data staging. Staging occurs after access is obtained and involves local file manipulation rather than authentication failures. Including this pattern would conflate the credential access phase with the collection and staging phase, weakening the hunting hypothesis and producing investigative noise unrelated to the exfiltration preparation the hunter is trying to detect.

Scheduled tasks created by the built-in backup service account to copy files to a known backup share each night.

Why it fails: Nightly backup copies to an established backup share are expected administrative behavior and are not evidence of adversary staging. The account, destination, and schedule all match documented operations. Selecting this would generate false positives and consume analyst time. Staging detection should focus on deviations such as new destinations, unusual archive formats, or collection from directories that the backup job does not normally cover.

Success of local service startup

Why it fails: Local service startup success is routine Windows behaviour and unrelated to credential theft; it indicates normal service control activity. It is tempting because service creation is sometimes abused for persistence, but that is a separate technique, not evidence of NTLM hash reuse across hosts.

High volume of Kerberos TGS requests

Why it fails: Pass-the-Hash reuses captured NTLM hashes, generating NTLM authentication, not Kerberos TGS requests. A TGS spike points to Kerberoasting or ticket abuse. Kerberos monitoring is tempting because it is central to credential-theft detection, but PtH bypasses Kerberos entirely.

The history of the geopolitical tension

Why it fails: Geopolitical background does not tell an operational team which indicators to hunt or block, so it fails the actionable-intelligence requirement. It tempts because context can explain an actor's motivation. Historical tension belongs in a strategic or executive assessment, where long-term intent and regional risk are the focus.

The stock price of the vendor

Why it fails: Vendor stock price has no bearing on adversary tactics, techniques or indicators, so it cannot guide operational detection or response. It tempts because business context sometimes accompanies threat reporting. Financial data belongs in a business-risk or vendor-diligence assessment, not an operational threat intelligence report.

The full raw database dump

Why it fails: A raw database dump is unfiltered evidence, not analysed intelligence, and would overwhelm an operational team without indicators or context. It tempts because raw data feels authoritative and complete. Full dumps belong in forensic investigation or evidence-handling workflows, where analysts examine artefacts directly.

Installation

Why it fails: Installation establishes persistence on a compromised host through malware or backdoors, occurring after delivery inside the endpoint, so network controls cannot see or remove it. It tempts because installation traffic can traverse the network, but endpoint detection and response handles this phase; network controls best defend reconnaissance, weaponisation and delivery.

Actions on Objectives

Why it fails: Actions on Objectives covers the attacker's final goals — data exfiltration, encryption or lateral impact — which occur after network traversal, so perimeter controls cannot reliably intercept them. It tempts because exfiltration crosses the network, but host, endpoint and data-layer controls address this phase; network controls best defend reconnaissance, weaponisation and delivery.

The total number of malware detections reported for each hash across all customers of your antivirus vendor.

Why it fails: Aggregate detection counts describe prevalence, not operational relationships between infrastructure elements. A widely detected hash may be commodity malware unrelated to the targeted intrusion set, and the count provides no connection between domains, IPs, or certificates. This element would not produce a defensible link in an infrastructure chart and could mislead the clustering effort.

The geographic country of the IP addresses based solely on a commercial geolocation database.

Why it fails: Geolocation alone is too coarse to establish meaningful links because entire hosting ranges in a country serve millions of unrelated customers. Using country as a link would connect your intrusion set to unrelated activity in the same region. Geolocation is useful as context, but it lacks the specificity needed to justify a link in an infrastructure chart.

The registrar's generic WHOIS privacy email address used by thousands of unrelated domains.

Why it fails: Generic WHOIS privacy addresses are shared by vast numbers of unrelated domains, so they create massive false-positive clusters rather than meaningful links. Including them would connect your intrusion set to unrelated campaigns and degrade the analytic value of the chart. Link analysis requires artifacts with low base rates in the general population, and privacy email addresses fail that test.

Removing all metadata.

Why it fails: Metadata records provenance, timestamps and source confidence, so stripping it destroys the very attributes analysts use to corroborate and score feeds. It is tempting because removing metadata can anonymise sensitive reporting, which suits sharing arrangements where source identity must be protected rather than reliability improved.

Increasing the ingest frequency.

Why it fails: Increasing ingest frequency does not improve data reliability; it merely raises volume and can amplify duplicate or stale indicators without validation. It is tempting because higher frequency suits real-time feeds where low-latency detection matters, such as rapidly changing indicators of compromise. Reliability instead requires corroboration, source vetting and confidence scoring.

Automatically trusting all feeds.

Why it fails: Automatically trusting all feeds removes validation, so unvetted or poisoned indicators enter detection unchecked, directly contradicting the reliability requirement. It is tempting because automation genuinely scales ingestion across many sources, and auto-trust would be the right choice only where every feed is contractually verified as authoritative and no corroboration is needed.

Conducting corporate financial payroll audits

Why it fails: Payroll audits are an internal financial-control and compliance function, producing assurance for stakeholders rather than intelligence satisfying stated requirements. Financial records can become intelligence when collected against a defined requirement, but auditing one's own payroll is not a collection management activity.

Configuring office building climate control thermostats

Why it fails: Thermostat settings are facilities data with no bearing on intelligence requirements, sources or collection gaps. Climate telemetry could matter only in a narrow physical-security assessment, which is not what a collection management framework, mapping requirements to collection disciplines and sources, addresses.

Writing custom assembly code for rootkit deployment

Why it fails: Rootkit assembly code is offensive tooling development, an execution activity that would follow collection planning, not a component of the framework itself. Writing implants is tempting because it feels operationally central, yet collection management concerns requirements, source tasking and gap analysis, not malware engineering.

The adversary's social media profile used for reconnaissance

Why it fails: An adversary's social media profile used for reconnaissance is an example of the Adversary axis, which captures information about the attacker's identity, motivation, and capabilities. While social media can be used in operations, the profile itself is not a communication infrastructure like C2 servers. Infrastructure specifically refers to the physical and logical structures that facilitate the attack, not the adversary's persona.

The victim organization's internal file server hostname

Why it fails: The victim organization's internal file server hostname is part of the Victim axis, not Infrastructure. The Victim axis describes the target of the attack, including their assets and identities. Infrastructure refers to the adversary's resources, not the victim's. Therefore, this option is incorrect for identifying adversary infrastructure.

The specific malware family and exploit code used in the attack

Why it fails: Malware families and exploit code belong to the Capability axis, not Infrastructure. Capability describes the tools, techniques, and malware the adversary uses to achieve their objectives. While capability and infrastructure interact, the malware itself is a weapon, not a communication channel. Therefore, this option does not represent the Infrastructure axis.

name

Why it fails: The 'name' property is optional for STIX 2.1 Indicator objects. It provides a human-readable name but is not required for the object to be valid. Analysts may include it for clarity, but its omission does not affect the indicator's functionality or compliance with the specification. Therefore, it is not a required property.

description

Why it fails: The 'description' property is optional in STIX 2.1 Indicator objects. It offers additional context but is not necessary for the object to be valid or functional. While helpful for human analysis, its absence does not prevent automated processing. Thus, it is not a required property for compliance with the specification.

valid_from

Why it fails: The 'valid_from' property is optional in STIX 2.1 Indicator objects. It indicates the time from which the indicator is considered valid, but it is not required for the object to be syntactically correct. While useful for temporal context, its absence does not invalidate the indicator, so it is not a mandatory property.

A bibliography of all external sources.

Why it fails: A bibliography lists references, not TTP relationships, so it cannot visualise adversary behaviour or map techniques to the MITRE ATT&CK matrix. It is tempting because source citation supports analytic rigour and traceability in CTI reporting, and would be the right choice when the requirement is evidencing provenance rather than depicting TTPs.

A photograph of the threat actor.

Why it fails: A photograph identifies a person, conveying nothing about techniques, tools or procedures, so it cannot visualise TTPs. It tempts because attribution imagery feels relevant to threat actors, but ATT&CK matrices or sequence diagrams are required to depict behaviour.

A raw list of every log entry captured.

Why it fails: Raw logs are not a visualization.

Assigning weights based on personal intuition.

Why it fails: Intuition-based weighting reintroduces the very cognitive bias ACH is designed to remove, because weights must derive from evidence diagnosticity, not gut feel. It is tempting since prioritising seems sensible, and subjective judgement is legitimate in expert elicitation, but ACH demands consistency and disproving rather than intuitive scoring.

Focusing only on the evidence that supports your primary theory.

Why it fails: Selecting only confirming evidence is confirmation bias, the failure ACH exists to counter; hypotheses must be tested against inconsistent data that refutes them. It is tempting because supporting material feels persuasive and is easy to gather, and advocacy has a place in debate, but ACH ranks hypotheses by how much evidence disconfirms each.

Limiting the number of hypotheses to one.

Why it fails: ACH requires multiple competing hypotheses evaluated against the same evidence; reducing to one eliminates the comparison that exposes bias, leaving confirmation unchecked. It is tempting because narrowing scope feels like focus, and a single hypothesis would suit a verification task, but ACH's diagnostic value depends on rivalry between alternatives.

The volume of indicators provided without context

Why it fails: Raw indicator volume without context cannot be validated or actioned, so it says nothing about reliability; enrichment, sourcing and false-positive rates matter. Bulk feeds are tempting because large numbers look comprehensive, and they would suit ingestion pipelines where context is added internally before detection.

The number of social media followers the vendor has

Why it fails: Follower counts measure marketing reach, not the accuracy, sourcing or timeliness of intelligence. Social media presence is tempting because a visible, active vendor appears credible, and it would be a reasonable due-diligence signal only when assessing brand reputation or community engagement, never analytic reliability.

description

Why it fails: description is an optional property in STIX 2.1; an Indicator is well-formed without it. It is tempting because analysts expect human-readable context alongside the pattern, and it is the correct choice when the goal is enriching a bundle for analyst consumption rather than satisfying schema requirements.

valid_until

Why it fails: STIX 2.1 defines valid_until as an optional timestamp on Indicator, not one of the required properties. It is tempting because it constrains how long an indicator applies, which is useful when publishing indicators with a defined expiry, but well-formedness does not depend on it.

Convert the report to PDF format to preserve formatting.

Why it fails: PDF conversion is not a requirement for TAXII sharing and may hinder automated processing. TAXII is designed for machine-to-machine exchange of structured threat intelligence, often in JSON or STIX format. Formatting preservation is not a primary concern; interoperability and clarity of markings are more important.

Include a disclaimer that the information is provided 'as is' without warranty.

Why it fails: While disclaimers can be useful, they are not a mandatory step for TAXII sharing or TLP compliance. The focus should be on proper marking and authorization. Adding a disclaimer does not address the core requirements of secure and compliant dissemination.

Encrypt the report using PGP before sending it via TAXII.

Why it fails: While encryption is important, TAXII 2.1 typically operates over HTTPS, providing transport encryption. PGP encryption is not a standard requirement for TAXII sharing and may not be supported by all partners. The focus should be on content marking and access control, not additional encryption layers unless specified by policy.

Devil's Advocacy to argue the opposite of the prevailing view regardless of evidence.

Why it fails: Devil's Advocacy can be useful, but it is not a structured technique for evaluating evidence; it deliberately argues a contrary position even when evidence does not support it. Used improperly, it can introduce noise rather than reduce bias. The question asks for techniques that improve defensibility through structured evaluation, and Devil's Advocacy lacks the systematic evidence-scoring framework of ACH or the assumption surfacing of a Key Assumptions Check.

Timeline analysis to sequence events chronologically without assessing causality.

Why it fails: Timeline analysis organizes events chronologically and is valuable for reconstructing incidents, but it does not by itself evaluate competing explanations or surface assumptions. It is a descriptive technique rather than a bias-reduction method. The analyst needs techniques that explicitly challenge interpretations and weigh evidence, which timeline analysis alone does not provide, even though it can feed into a broader structured process.

Brainstorming to generate as many ideas as possible without evaluating them.

Why it fails: Brainstorming is useful for generating hypotheses or mitigation ideas, but it does not evaluate evidence or reduce bias in conclusions. It is a divergent thinking tool, not an analytic technique for weighing artifacts. The scenario calls for structured methods that improve defensibility of conclusions drawn from a large artifact set; brainstorming alone would not provide the rigor, repeatability, or audit trail needed.

Frequent NXDOMAIN responses for typo-like domain names across the entire organization.

Why it fails: Widespread NXDOMAIN responses for typo-like names usually reflect user mistyping, ad-blocking, or domain takedowns, not tunneling. Tunneling typically targets a single attacker-controlled domain that resolves successfully, so failures are not the defining feature. Organization-wide NXDOMAIN noise would obscure rather than reveal a targeted exfiltration channel.

Queries that use the A record type for well-known public domains from many different hosts.

Why it fails: A-record lookups for popular domains from many hosts describe ordinary web browsing and shared service access. This pattern is exactly what a normal enterprise DNS profile looks like, so it provides no separation between tunneling and benign activity. Using it as a hunt lead would generate overwhelming false positives across the environment.

Periodic PTR record queries for internal RFC1918 addresses from a single host.

Why it fails: PTR lookups for internal addresses are routine reverse-resolution activity performed by many services, including monitoring and inventory tools. They carry no exfiltrated data and occur in normal operations. This pattern would not distinguish a tunneling implant from standard internal DNS behavior, so it is a poor tunneling indicator.

Vulnerability remediation

Why it fails: Vulnerability remediation is a risk-management and IT operations activity in which identified flaws are patched or mitigated. Although intelligence can inform prioritization of remediation, patching systems is not a phase of the threat intelligence lifecycle, which ends with dissemination and consumer feedback rather than with operational change.

Penetration testing

Why it fails: Penetration testing is an offensive security assessment activity that validates controls by attempting exploitation under authorization. It is not a stage in the threat intelligence lifecycle, and although findings from testing can inform requirements during planning and direction, the testing activity itself is unrelated to the collect-process-analyze-disseminate flow.