CTIA

88問 • 2ヶ月前

問題一覧

In which of the following attacks does the attacker exploit vulnerabilities in a computerapplication before the software developer can release a patch for them?

Zero-day attack

In which of the following forms of bulk data collection are large amounts of data first collectedfrom multiple sources in multiple formats and then processed to achieve threat intelligence?

Unstructured form

Sam works as an analyst in an organization named InfoTech Security. He was asked to collectinformation from various threat intelligence sources. In meeting the deadline, he forgot to verify thethreat intelligence sources and used data from an open-source data provider, who offered it at a verylow cost. Through it was beneficial at the initial stage but relying on such data providers can produceunreliable data and noise putting the organization network into risk. What mistake Sam did that led to this situation?

Sam used unreliable intelligence sources.

What is the correct sequence of steps involved in scheduling a threat intelligence program? 1. Review the project charter 2. Identify all deliverables 3. Identify the sequence of activities 4. Identify task dependencies 5. Develop the final schedule 6. Estimate duration of each activity 7. Identify and estimate resources for all activities 8. Define all activities 9. Build a work breakdown structure (WBS)

1-->9-->2-->8-->3-->7-->4-->6-->5

An XYZ organization hired Mr. Andrews, a threat analyst. In order to identify the threats andmitigate the effect of such threats, Mr. Andrews was asked to perform threat modeling. During theprocess of threat modeling, he collected important information about the treat actor andcharacterized the analytic behavior of the adversary that includes technological details, goals, andmotives that can be useful in building a strong countermeasure. What stage of the threat modeling is Mr. Andrews currently in?

Threat profiling and attribution

In a team of threat analysts, two individuals were competing over projecting their ownhypotheses on a given malware. However, to find logical proofs to confirm their hypotheses, thethreat intelligence manager used a de-biasing strategy that involves learning strategic decisionmaking in the circumstances comprising multistep interactions with numerous representatives, either4IT Certification Guaranteed, The Easy Way!having or without any perfect relevant information. Which of the following de-biasing strategies the threat intelligence manager used to confirm theirhypotheses?

Game theory

Alice, an analyst, shared information with security operation managers and networkoperations center (NOC) staff for protecting the organizational resources against various threats.Information shared by Alice was highly technical and include threat actor TTPs, malware campaigns,tools used by threat actors, and so on. Which of the following types of threat intelligence was shared by Alice?

Tactical threat intelligence

A threat analyst obtains an intelligence related to a threat, where the data is sent in the formof a connection request from a remote host to the server. From this data, he obtains only the IPaddress of the source and destination but no contextual information. While processing this data, heobtains contextual information stating that multiple connection requests from different geo-locations5IT Certification Guaranteed, The Easy Way!are received by the server within a short time span, and as a result, the server is stressed andgradually its performance has reduced. He further performed analysis on the information based onthe past and present experience and concludes the attack experienced by the client organization. Which of the following attacks is performed on the client organization?

Distributed Denial-of-Service (DDoS) attack

Kathy wants to ensure that she shares threat intelligence containing sensitive informationwith the appropriate audience. Hence, she used traffic light protocol (TLP). Which TLP color would you signify that information should be shared only within a particularcommunity?

Green

Kim, an analyst, is looking for an intelligence-sharing platform to gather and share threatinformation from a variety of sources. He wants to use this information to develop security policies toenhance the overall security posture of his organization. Which of the following sharing platforms should be used by Kim?

Blueliv threat exchange network

Mr. Bob, a threat analyst, is performing analysis of competing hypotheses (ACH). He hasreached to a stage where he is required to apply his analysis skills effectively to reject as manyhypotheses and select the best hypotheses from the identified bunch of hypotheses, and this is donewith the help of listed evidence. Then, he prepares a matrix where all the screened hypotheses areplaced on the top, and the listed evidence for the hypotheses are placed at the bottom. What stage of ACH is Bob currently in?

Diagnostics

An organization suffered many major attacks and lost critical information, such as employeerecords, and financial information. Therefore, the management decides to hire a threat analyst toextract the strategic threat intelligence that provides high-level information regarding current cybersecurity posture, threats, details on the financial impact of various cyber-activities, and so on. Which of the following sources will help the analyst to collect the required intelligence?

OSINT, CTI vendors, ISAO/ISACs

ABC is a well-established cyber-security company in the United States. The organizationimplemented the automation of tasks such as data enrichment and indicator aggregation. They alsojoined various communities to increase their knowledge about the emerging threats. However, thesecurity teams can only detect and prevent identified threats in a reactive approach. Based on threat intelligence maturity model, identify the level of ABC to know the stage at which theorganization stands with its security and vulnerabilities.

Level 2: increasing CTI capabilities

An attacker instructs bots to use camouflage mechanism to hide his phishing and malware8IT Certification Guaranteed, The Easy Way!delivery locations in the rapidly changing network of compromised bots. In this particular technique,a single domain name consists of multiple IP addresses. Which of the following technique is used by the attacker?

Fast-Flux DNS

Joe works as a threat intelligence analyst with Xsecurity Inc. He is assessing the TI program bycomparing the project results with the original objectives by reviewing project charter. He is alsoreviewing the list of expected deliverables to ensure that each of those is delivered to an acceptablelevel of quality. Identify the activity that Joe is performing to assess a TI program's success or failure.

Conducting a gap analysis

A threat analyst wants to incorporate a requirement in the threat knowledge repository thatprovides an ability to modify or delete past or irrelevant threat data.Which of the following requirement must he include in the threat knowledge repository to fulfil hisneeds?

Data management

During the process of threat intelligence analysis, John, a threat analyst, successfullyextracted an indication of adversary's information, such as Modus operandi, tools, communicationchannels, and forensics evasion strategies used by adversaries. Identify the type of threat intelligence analysis is performed by John.

Tactical threat intelligence analysis

A team of threat intelligence analysts is performing threat analysis on malware, and each ofthem has come up with their own theory and evidence to support their theory on a given malware. Now, to identify the most consistent theory out of all the theories, which of the following analyticprocesses must threat intelligence manager use?

Analysis of competing hypotheses (ACH)

Alison, an analyst in an XYZ organization, wants to retrieve information about a company'swebsite from the time of its inception as well as the removed information from the target website. What should Alison do to get the information he needs.

Alison should use https://archive.org to extract the required website information.

Sarah is a security operations center (SOC) analyst working at JW Williams and Sonsorganization based in Chicago. As a part of security operations, she contacts information providers(sharing partners) for gathering information such as collections of validated and prioritized threatindicators along with a detailed technical analysis of malware samples, botnets, DDoS attackmethods, and various other malicious tools. She further used the collected information at the tactical and operational levels. Sarah obtained the required information from which of the following types of sharing partner?

Providers of threat data feeds

Which of the following characteristics of APT refers to numerous attempts done by theattacker to gain entry to the target's network?

Attack origination points

H&P, Inc. is a small-scale organization that has decided to outsource the network securitymonitoring due to lack of resources in the organization. They are looking for the options where theycan directly incorporate threat intelligence into their existing network defense solutions. Which of the following is the most cost-effective methods the organization can employ?

Recruit managed security service providers (MSSP)

Jim works as a security analyst in a large multinational company. Recently, a group of hackerspenetrated into their organizational network and used a data staging technique to collect sensitivedata. They collected all sorts of sensitive data about the employees and customers, business tacticsof the organization, financial information, network infrastructure information and so on. What should Jim do to detect the data staging before the hackers exfiltrate from the network?

Jim should monitor network traffic for malicious file transfers, file integrity monitoring, and eventlogs.

Lizzy, an analyst, wants to recognize the level of risks to the organization so as to plan countermeasures against cyber attacks. She used a threat modelling methodology where she performed the following stages: Stage 1: Build asset-based threat profiles Stage 2: Identify infrastructure vulnerabilities Stage 3: Develop security strategy and plans Which of the following threat modelling methodologies was used by Lizzy in the aforementioned scenario?

OCTAVE

Tim is working as an analyst in an ABC organization. His organization had been facing many challenges in converting the raw threat intelligence data into meaningful contextual information. After inspection, he found that it was due to noise obtained from misrepresentation of data from huge data collections. Hence, it is important to clean the data before performing data analysis using techniques such as data reduction. He needs to choose an appropriate threat intelligence framework that automatically performs data collection, filtering, and analysis for his organization. Which of the following threat intelligence frameworks should he choose to perform such task?

TC complete

In which of the following storage architecture is the data stored in a localized system, server, or storage hardware and capable of storing a limited amount of data in its database and locally available for data usage?

Centralized storage

Jian is a member of the security team at Trinity, Inc. He was conducting a real-time assessment of system activities in order to acquire threat intelligence feeds. Heacquired feeds from sources like honeynets, P2P monitoring. infrastructure, and application logs. Which of the following categories of threat intelligence feed was acquired by Jian?

Proactive surveillance feeds

Alice, a threat intelligence analyst at HiTech Cyber Solutions, wants to gather information for identifying emerging threats to the organization and implement essential techniques to prevent their systems and networks from such attacks. Alice is searching for online sources to obtain information such as the method used to launch an attack, and techniques and tools used to perform an attack and the procedures followed for covering the tracks after an attack. Which of the following online sources should Alice use to gather such information?

Hacking forums

Cybersol Technologies initiated a cyber-threat intelligence program with a team of threat intelligence analysts. During the process, the analysts started converting the raw data into useful information by applying various techniques, such as machine-based techniques, and statistical methods. In which of the following phases of the threat intelligence lifecycle is the threat intelligence team currently working?

Processing and exploitation

Moses, a threat intelligence analyst at InfoTec Inc., wants to find crucial information about the potential threats the organization is facing by using advanced Google searchoperators. He wants to identify whether any fake websites are hosted at the similar to the organization's URL. Which of the following Google search queries should Moses use?

related: www.infothech.org

Bob, a threat analyst, works in an organization named TechTop. He was asked to collect intelligence to fulfil the needs and requirements of the Red Tam present within the organization. Which of the following are the needs of a RedTeam?

Intelligence on latest vulnerabilities, threat actors, and their tactics, techniques, and procedures (TTPs)

A network administrator working in an ABC organization collected log files generated by a traffic monitoring system, which may not seem to have useful information, but afterperforming proper analysis by him, the same information can be used to detect an attack in the network. Which of the following categories of threat information has he collected?

Low-level data

Daniel is a professional hacker whose aim is to attack a system to steal data and money for profit. He performs hacking to obtain confidential data such as social security numbers, personally identifiable information (PII) of an employee, and credit card information. After obtaining confidential data, he further sells the information on the black market to make money. Daniel comes under which of the following types of threat actor.

Organized hackers

Steve works as an analyst in a UK-based firm. He was asked to perform network monitoring to find any evidence of compromise. During the network monitoring, he came to know that there are multiple logins from different locations in a short time span. Moreover, he also observed certain irregular log in patterns from locations where the organization does not have business relations. This resembles that somebody is trying to steal confidential information. Which of the following key indicators of compromise does this scenario present?

Geographical anomalies

Walter and Sons Company has faced major cyber attacks and lost confidential data. The company has decided to concentrate more on the security rather than other resources. Therefore, they hired Alice, a threat analyst, to perform data analysis. Alice was asked to perform qualitative data analysis to extract useful information from collected bulk data. Which of the following techniques will help Alice to perform qualitative data analysis?

Brainstorming, interviewing, SWOT analysis, Delphi technique, and so on

Enrage Tech Company hired Enrique, a security analyst, for performing threat intelligence analysis. While performing data collection process, he used a counterintelligence mechanism where a recursive DNS server is employed to perform interserver DNS communication and when a request is generated from any name server to the recursive DNS server, the recursive DNS servers log the responses that are received. Then it replicates the logged data and stores the data in the central database. Using these logs, he analyzed the malicious attempts that took place over DNS infrastructure. Which of the following cyber counterintelligence (CCI) gathering technique has Enrique used for data collection?

Data collection through passive DNS monitoring

Miley, an analyst, wants to reduce the amount of collected data and make the storing and sharing process easy. She uses filtering, tagging, and queuing technique to sort out the relevant and structured data from the large amounts of unstructured data. Which of the following techniques was employed by Miley?

Normalization

Andrews and Sons Corp. has decided to share threat information among sharing partners. Garry, a threat analyst, working in Andrews and Sons Corp., has asked to follow a trust model necessary to establish trust between sharing partners. In the trust model used by him, the first organization makes use of a body of evidence in a second organization, and the level of trust between two organizations depends on the degree and quality of evidence provided by the first organization. Which of the following types of trust model is used by Garry to establish the trust?

Validated trust

Michael, a threat analyst, works in an organization named TechTop, was asked to conduct a cyber-threat intelligence analysis. After obtaining information regarding threats, he has started analyzing the information and understanding the nature of the threats. What stage of the cyber-threat intelligence is Michael currently in?

Known unknowns

John, a professional hacker, is trying to perform APT attack on the target organization network. He gains access to a single system of a target organization and tries to obtain administrative login credentials to gain further access to the systems in the network using various techniques. What phase of the advanced persistent threat lifecycle is John currently in?

Expansion

Which of the following types of threat attribution deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its target?

True attribution

Tyrion, a professional hacker, is targeting an organization to steal confidential information. He wants to perform website footprinting to obtain the following information, which is hidden in the web page header. Connection status and content type Accept-ranges and last-modified information X-powered-by information Web server in use and its version Which of the following tools should the Tyrion use to view header content?

Burp suite

Henry. a threat intelligence analyst at ABC Inc., is working on a threat intelligence program. He was assigned to work on establishing criteria for prioritization of intelligence needs and requirements. Which of the following considerations must be employed by Henry to prioritize intelligence requirements?

Understand frequency and impact of a threat

Karry, a threat analyst at an XYZ organization, is performing threat intelligence analysis. During the data collection phase, he used a data collection method that involves no participants and is purely based on analysis and observation of activities and processes going on within the local boundaries of the organization. Identify the type data collection method used by the Karry.

Passive data collection

Which of the following components refers to a node in the network that routes the traffic from a workstation to external command and control server and helps in identification of installed malware in the network?

Gateway

SecurityTech Inc. is developing a TI plan where it can drive more advantages in less funds. In the process of selecting a TI platform, it wants to incorporate a feature that ranks elements such as intelligence sources, threat actors, attacks, and digital assets of the organization, so that it can put in more funds toward the resources which are critical for the organization's security. Which of the following key features should SecurityTech Inc. consider in their TI plan for selecting the TI platform?

Scoring

An analyst wants to disseminate the information effectively so that the consumers can acquire and benefit out of the intelligence. Which of the following criteria must an analyst consider in order to make the intelligence concise, to the point, accurate, and easily understandable and must consist of a right balance between tables, narrative, numbers, graphics, and multimedia?

The right presentation

Tracy works as a CISO in a large multinational company. She consumes threat intelligence to understand the changing trends of cyber security. She requires intelligence to understand the current business trends and make appropriate decisions regarding new technologies, security budget, improvement of processes, and staff. The intelligence helps her in minimizing business risks and protecting the new technology and business initiatives. Identify the type of threat intelligence consumer is Tracy.

Strategic users

An analyst is conducting threat intelligence analysis in a client organization, and during the information gathering process, he gathered information from the publicly available sources and analyzed to obtain a rich useful form of intelligence. The information source that he used is primarily used for national security, law enforcement, and for collecting intelligence required for business or strategic decision making. Which of the following sources of intelligence did the analyst use to collect information?

OSINT

Jame, a professional hacker, is trying to hack the confidential information of a target organization. He identified the vulnerabilities in the target system and created a tailored deliverable malicious payload using an exploit and a backdoor to send it to the victim. Which of the following phases of cyber kill chain methodology is Jame executing?

Weaponization

A company, TechSoft Solutions, implemented a threat intelligence program and began developing operational capabilities obtained in the previous levels and created an organized team approach for strategic analysis. The company also established necessary intelligence processes and workflows to extract their own threat intelligence. Identify the threat intelligence maturity level at which the company stands.

Level 3: CTI program in place

Tech Crunch Inc. has hired John, who is a professional threat intelligence analyst. He was asked to conduct threat intelligence analysis that provides contextual information about the security events and incidents that further help the organization to disclose potential risks, provide greater insight into attacker methodologies, identify past malicious activities, and perform investigations on malicious activities in a more efficient way. Identify the type of threat intelligence John is going to perform for the organization.

Operational threat intelligence

You are a cybersecurity analyst working at a financial institution. An unusual pattern of financial transactions was detected, suggesting potential fraud or money laundering. What specific type of threat intelligence would you rely on to analyze these financial activities and identify potential risks?

FININT

Sean works as a threat intelligence analyst. He is assigned a project for information gathering on a client’s network to find a potential threat. He started analysis and was trying to find out the company’s internal URLs, looking for any information about the different departments and business units. He was unable to find any information. What should Sean do to get the information he needs?

Sean should use online services such as netcraft.com to find the company’s internal URLs

While monitoring network activities, an unusual surge in outbound traffic was noticed, and a potential security incident was suspected. In the context of incident responses, what is the initial stage at which you actively recognize and confirm the presence of an incident?

Identification

Jack is a professional hacker who wants to perform remote exploitation on the target system of an organization. He established a two-way communication channel between the victim’s system and his server. He used encryption techniques to hide the presence of a communication channel on a victim’s system and further applied privilege escalation techniques to exploit the system. What phase of the cyber kill chain methodology is Jack currently in?

Command and control

Bob is a threat intelligence analyst in Global Technologies Inc. While extracting threat intelligence, he identified that the organization is vulnerable to various application threats that can be exploited by attackers. Which of the following are the possible application threats that have been identified by Bob?

SQL injection and buffer overflow attack

Marry wants to follow an iterative and incremental approach to prioritize requirements in order to protect the important assets of an organization against attacks. She wants to set the requirements based on the order of priority, where the most important requirement must be met before, for a greater chance of success. She wants to apply prioritization tasks, scenarios, use cases, tests, and so on. Which of the following methodologies should Marry use to prioritize the requirements?

MoSCoW

A consortium was established in a collaborative effort to strengthen the cybersecurity posture of multiple organizations within an industry sector. The participating entities decided to adopt a threat intelligence exchange architecture in which all threat data is collected, analyzed, and disseminated through a single central hub. What type of threat intelligence exchange architecture was implemented in this scenario?

Centralized exchange architecture

While analyzing a series of security incidents, you notice a pattern of attacks originating from specific geographical locations. To gain deeper insight into the spatial aspects of these threats, what contextualization method would you employ to understand the geographic origin and distribution of the attacks?

Spatial context

Tech Knights Inc., a small-scale company, has decided to share the intelligence information with various organizations using a nonprofit association that provides a secure place to accumulate and share the information about the cyber threats in the industry, and it also provides an extended service of data analysis to the organizational network. Which of the following types of sharing organizations should Tech Knights Inc. use to share information?

Information sharing and analysis centers (ISACs)

The cybersecurity team seeks to enhance its threat hunting capabilities in a large enterprise. They plan to search systematically and proactively for adversaries within their networks. What types of threat hunting approaches are they most likely to adopt, involving predefined processes, methodologies, and frameworks for their investigation?

Structured threat hunting

In which of the following phases of the threat intelligence lifecycle is raw data converted into meaningful information by highly trained professionals using sophisticated technology and tools?

Processing and exploitation

John, a threat intelligence analyst in Cybertech Company, was asked to obtain information that provides greater insight into the current cyber risks. To gather such information, John needs to find the answer of the following questions: • Why the organization might be attacked? • How the organization might be attacked? • Who might be the intruders? Identify the type of security testing John is going to perform.

Intelligence-led security testing

Which component of risk management involves evaluating and ranking risks based on their significance, allowing organizations to focus resources on addressing the most critical threats?

Risk prioritization

CalSoft is a large-scale organization that wants to establish a certain level of trust before sharing intelligence within the organization. As various departments in the organization share information frequently, they decided to use different trust models for different departments. In addition, the organization acts as a provider of threat intelligence to all connected members and organizations. Which of the following organizational trust models should be used by CalSoft?

Hybrid trust

Kira works as a security analyst in an organization. She was asked to define and set up the requirements before collecting threat intelligence information. The requirements should focus on what must be collected in order to fulfil production intelligence. Which of the following categories of threat intelligence requirements should Kira focus on?

Collection requirements

Jacob, a professional hacker, created an exact replica of an online shopping website. He copied the entire contents of the original website onto the local system that enables him to create a dummy spam website for performing social engineering attacks over the employees. What type of technique did Jacob use for cloning the website?

Website mirroring

John is a lead cybersecurity analyst preparing to gather threat intelligence for client organization. Arrange the following steps in the correct sequence, outlining the process that John would follow to plan an effective threat intelligence collection: 1. Structuring/normalization 2. Sharing information 3. Data collection 4. Storing and visualizing data

3 -> 1 -> 4 -> 2

Henry, working as a threat analyst in an organization named MylesTech, wants to share gathered intelligence. He wants to share the intelligence with a broad range of communities that can be trusted more, but the sensitivity of information is less. Which of the following tiers of the sharing model must be employed by Henry?

Public tier

What term describes the trust establishment process, wherein the first organization relies on a body of evidence presented to the second organization, and the level of trust is contingent upon the degree and quality of evidence provided by the initiating organization?

Validated trust

Steve is working as an analyst for Highlanders & Co. While performing data analysis, he used a method in which he included a list of all activities required to complete the project, time, dependencies, and logical endpoints such as milestones to acquire information about the relationship between various activities and the period of the activities obtained. Which of the following data analysis methods was used by Steve?

Critical path analysis

Organizations must choose a right threat intelligence platform to assess and leverage intelligence information, monitor multiple enforcement points, manage intelligence feeds, and select appropriate security for the digital assets. Which of the following key factors ensures that the TI platform offers a structured way to perform investigations on attacks by processing the threat intelligence and utilizing the internal security controls to automate the detection process?

Workflow

In which of the following levels of the threat hunting maturity model (HMM) does an organization use threat intelligence to search for anomalies in the network, follow the latest threat reports gathered from open and closed sources, and use open-source tools for analysis?

Level 2: Procedural

Flora, a threat intelligence analyst at PanTech Cyber Solutions, is working on a threat intelligence program. She is trying to collect the company’s crucial information through online job sites. Which of the following information will Flora obtain through job sites?

Hardware and software information, network-related information, and technologies used by the company

You are a Security Operations Center (SOC) analyst responsible for monitoring and safeguarding the organization’s network. During routine activities, identify a potential vulnerability that can expose critical systems to exploitation. In what specific aspects of cybersecurity would you actively engage in when addressing and mitigating this vulnerability?

Vulnerability management

To extract useful intelligence from the gathered bulk data and to improve the efficiency of the composite bulk data, Sam, a threat analyst, follows a data analysis method where he creates a logical sequence of events based on the assumptions of an adversary’s proposed actions, mechanisms, indicators, and implications. To develop accurate predictions, he further takes into consideration the important factors including bad actors, methods, vulnerabilities, targets, and so on. Which of the following data analysis methods is used by Sam to extract useful intelligence out of bulk data?

Lindrpin analysis

You are the leading cybersecurity analyst at financial institutions. An anomaly is detected in the network, suggesting a potential security threat. To proactively investigate and mitigate the risk, arrange the following steps in the correct sequence as part of the threat hunting process: 1. Investigation 2. Collect and process data 3. Response 4. Hypothesis 5. Trigger • a) 5 → 3 → 1 → 4 → 2 • b) 3 → 2 → 5 → 1 → 4 • c) 4 → 1 → 3 → 5 → 2 • d) 4 → 2 → 5 → 1 → 3

Jamie, an analyst, was asked to perform statistical data analysis process on the acquired data. While performing the analysis, he used conditional probability method so as to understand the data and build insights for response actions based on it. What stage of the statistical data analysis is Jamie currently in?

Data correlation

Mario is working as an analyst in an XYZ organization in the United States. He has been asked to prepare a threat landscape report to provide in-depth awareness and greater insight into the threats his organization is facing. Which of the following details should she include to prepare a threat landscape report?

A summary of threat actors most likely targeting the organization along with their motivations, intentions, and TTPs.

Philip, a professional hacker, is planning to attack an organization. In order to collect information, he covertly collects information from the target person by maintaining a personal or other relationship with the target person. Which of the following intelligence sources is used by Philip to collect information about the target organization?

CHIS

As the CEO of a multinational corporation, you focus on making decisions that align with the organization’s long-term goals and overall business strategies. What type of threat intelligence would be most valuable in guiding your decisions to enhance a company’s resilience against emerging cyber threats?

Strategic threat intelligence

Marie, a threat analyst at an organization named TechSavvy, was asked to perform operational threat intelligence analysis to get contextual information about security events and incidents. Which of the following sources does Marie need to use to perform operational threat intelligence analysis?

Activity-related attacks, social media sources, chat room conversations

Two cybersecurity teams from different organizations joined forces to combat a rapidly evolving malware campaign targeting their industry. They exchange real-time information about the attackers’ techniques, compromised systems, and immediate defensive actions. What type of threat intelligence sharing characterizes this collaboration?

Sharing tactical threat intelligence

An organization, namely, Highlander, Inc., decided to integrate threat intelligence into the incident response process for rapid detection and recovery from various security incidents. In which of the following phases of the incident response management does the organization utilize operational and tactical threat intelligence to provide context to the alerts generated by various security mechanisms?

Phase 2: event

James, a senior threat intelligence officer, was tasked with assessing the success and failure of the threat intelligence program established by the organization. As part of the assessment, James reviewed the outcome of the intelligence program, determined if any improvements were required in the program, and identified the past learnings that can be applied to the future program. Identify the activity performed by James in the above scenario.

Report findings and recommendations

A threat analyst working in XYZ Company was asked to perform threat intelligence analysis. During the information collection phase, he used a social engineering technique where he pretended to be a legitimate or authorized person. Using this technique, he gathered sensitive information by scanning terminals for passwords, searching important documents on the desks, rummaging bins, and so on. Which of the following social engineering techniques was used by the analyst for information collection?

Impersonation

An autonomous robot was deployed to navigate and learn about the environment. Through a trial-and-error process, the robot refines its actions based on positive or negative feedback to maximize cumulative rewards. What type of machine learning will the robot employ in this scenario?

Reinforcement learning

問題一覧

In which of the following attacks does the attacker exploit vulnerabilities in a computerapplication before the software developer can release a patch for them?

Zero-day attack

In which of the following forms of bulk data collection are large amounts of data first collectedfrom multiple sources in multiple formats and then processed to achieve threat intelligence?

Unstructured form

Sam used unreliable intelligence sources.

1-->9-->2-->8-->3-->7-->4-->6-->5

Threat profiling and attribution

Game theory

Tactical threat intelligence

Distributed Denial-of-Service (DDoS) attack

Green

Blueliv threat exchange network

Diagnostics

OSINT, CTI vendors, ISAO/ISACs

Level 2: increasing CTI capabilities

Fast-Flux DNS

Conducting a gap analysis

Data management

Tactical threat intelligence analysis

Analysis of competing hypotheses (ACH)

Alison should use https://archive.org to extract the required website information.

Providers of threat data feeds

Which of the following characteristics of APT refers to numerous attempts done by theattacker to gain entry to the target's network?

Attack origination points

Recruit managed security service providers (MSSP)

Jim should monitor network traffic for malicious file transfers, file integrity monitoring, and eventlogs.

OCTAVE

TC complete

Centralized storage

Proactive surveillance feeds

Hacking forums

Processing and exploitation

related: www.infothech.org

Intelligence on latest vulnerabilities, threat actors, and their tactics, techniques, and procedures (TTPs)

Low-level data

Organized hackers

Geographical anomalies

Brainstorming, interviewing, SWOT analysis, Delphi technique, and so on

Data collection through passive DNS monitoring

Normalization

Validated trust

Known unknowns

Expansion

True attribution

Burp suite

Understand frequency and impact of a threat

Passive data collection

Gateway

Scoring

The right presentation

Strategic users

OSINT

Weaponization

Level 3: CTI program in place

Operational threat intelligence

FININT

Sean should use online services such as netcraft.com to find the company’s internal URLs

Identification

Command and control

SQL injection and buffer overflow attack

MoSCoW

Centralized exchange architecture

Spatial context

Information sharing and analysis centers (ISACs)

Structured threat hunting

In which of the following phases of the threat intelligence lifecycle is raw data converted into meaningful information by highly trained professionals using sophisticated technology and tools?

Processing and exploitation

Intelligence-led security testing

Which component of risk management involves evaluating and ranking risks based on their significance, allowing organizations to focus resources on addressing the most critical threats?

Risk prioritization

Hybrid trust

Collection requirements

Website mirroring

3 -> 1 -> 4 -> 2

Public tier

Validated trust

Critical path analysis

Workflow

Level 2: Procedural

Hardware and software information, network-related information, and technologies used by the company

Vulnerability management

Lindrpin analysis

Data correlation

A summary of threat actors most likely targeting the organization along with their motivations, intentions, and TTPs.

CHIS

Strategic threat intelligence

Activity-related attacks, social media sources, chat room conversations

Sharing tactical threat intelligence

Phase 2: event

Report findings and recommendations

Impersonation

Reinforcement learning