Introduction TO Threat Intelligence

Which TWO of the following are considered 'Technical' threat intelligence sources? (Choose two)

You are drafting a threat report for the C-suite. Which of the following is most appropriate for this audience?

Which TWO challenges are associated with Cloud Threat Intelligence? (Choose two)

When evaluating the quality of a threat intelligence source, what does the 'Timeliness' attribute specifically measure?

Which of the following is an example of an 'Indicator of Compromise' (IOC)?

In MISP, you are ingesting a CSV file of indicators. You notice that the 'Attribute' field is mapping correctly, but the 'Category' field is defaulting to 'Network activity'. What is the most efficient way to ensure the 'Category' field is parsed correctly for future imports?

You are configuring a TAXII client to pull indicators from an external threat feed. The client returns a 403 Forbidden error despite valid credentials. Which setting should you verify in the TAXII server configuration?

Your organization uses the Cyber Kill Chain. You have identified that an adversary has successfully established persistent communication with an external host. Which phase is currently active?

You are using the STIX 2.1 standard to document an observation. You need to link a 'Malware' object to a 'Vulnerability' object. Which Relationship object type should you use?

Which THREE actions are typically performed during the 'Processing' phase of the threat intelligence lifecycle? (Choose three)

Which TWO of the following are benefits of using a Threat Intelligence Platform (TIP)? (Choose two)

You are assessing a threat actor's 'Capability'. Which of the following would be considered a CTI Capability indicator?

Which component of the threat intelligence lifecycle involves the conversion of raw data into a format suitable for analysis?

Which TWO of the following are primary components of the 'Adversary' node in the Diamond Model? (Choose two)

You are managing threat intelligence in a cloud-native environment. You need to identify indicators related to unauthorized API key usage in AWS. Which AWS service provides the most relevant CTI data for this investigation?

During the 'Direction' phase of the threat intelligence lifecycle, your stakeholder requests a focus on 'Supply Chain threats'. How should you refine this requirement?

In the threat intelligence lifecycle, what is the 'Dissemination' phase primarily concerned with?

You are reviewing the Diamond Model of Intrusion Analysis for a recent incident. The 'Victim' node is populated with the targeted organization's identity. Which element should be populated in the 'Infrastructure' node?

You are using the MITRE ATT&CK framework to map an adversary's actions. The adversary uses 'PowerShell' to execute commands on the victim. Which Tactic does this fall under?

Which THREE factors should be considered when evaluating the reliability of a threat intelligence vendor? (Choose three)

You have received a raw feed of IP addresses. Before putting these into your firewall, you perform 'vetting'. What is the primary purpose of this vetting step?

You are integrating a new Threat Intelligence Platform (TIP) into your SIEM. The TIP supports the OpenIOC format. What is the primary advantage of using OpenIOC over simple CSV lists?