I85PREP
⌘ K
BTL1 study materials
BTL1 study resources

BTL1 practice questions

One question at a time. Build your BTL1 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Phishing Analysis

Which email header field is most useful for identifying the actual sending server that handed a message to the recipient's mail system?

  1. The Subject header line
  2. The topmost Received header line Correct answer.
  3. The Reply-To header line
  4. The Message-ID header line

Explanation

Received headers are added by each mail transfer agent as a message passes through it, so the topmost one reflects the last hop before delivery and identifies the delivering server. Analysts read them bottom-up to reconstruct the full path. Subject, Reply-To and Message-ID are set by the sender's software and can be forged freely.

Question 2Phishing Analysis

An analyst inspects a suspicious message and sees the display name 'Payroll Department' but the address [email protected]. What is the most accurate conclusion?

  1. The message is legitimate because payroll appears in the display name
  2. The domain proves the sender works for the payroll team
  3. The display name is spoofed to build trust and does not match the domain Correct answer.
  4. The address is safe because .top domains are reserved for business

Explanation

Display names are free text and are not verified by the mail protocol, so an attacker can type any trusted-sounding label. The actual domain in the address is what determines the true origin and should be compared against the organisation's real domain. A mismatch between a trusted display name and an unrelated domain is a classic impersonation indicator.

Question 3Phishing Analysis

What does the SPF record of a domain primarily declare?

  1. Which public key should be used to sign outgoing messages
  2. Where bounce messages for the domain should be delivered
  3. Which mailbox should receive abuse reports about the domain
  4. Which IP addresses are authorised to send mail for that domain Correct answer.

Explanation

SPF is a DNS TXT record listing the hosts and networks permitted to send mail on behalf of a domain. Receiving servers check the connecting IP against that list and record a pass, fail or softfail result. It does not encrypt, sign or redirect anything.

Question 4Phishing Analysis

Which technology cryptographically signs selected message headers and a hash of the body so a receiver can verify the message was not altered in transit?

  1. DMARC
  2. SPF
  3. DKIM Correct answer.
  4. BIMI

Explanation

DKIM adds a digital signature header computed over chosen headers and a body hash using a private key; the receiver validates it with the public key published in DNS. Any modification to signed content breaks the signature. SPF and DMARC are policy and alignment mechanisms rather than body-signing schemes.

Question 5Phishing Analysis

In a DMARC policy record, what does the p=none setting instruct receiving servers to do with messages that fail alignment?

  1. Take no action on delivery but report the results Correct answer.
  2. Quarantine the message as suspected spam
  3. Rewrite the message headers to fix alignment
  4. Reject the message during the SMTP session

Explanation

The p=none policy is a monitoring mode: receivers still evaluate SPF and DKIM alignment and send aggregate reports, but they deliver failing mail normally. It is typically used before moving to quarantine or reject. It never rewrites headers or blocks delivery.

Question 6Phishing Analysis

Which artefact in a suspected phishing email most reliably reveals the true destination of a hyperlink without visiting it?

  1. The visible anchor text of the link
  2. The position of the link within the body
  3. The href value in the raw message source Correct answer.
  4. The font colour used for the link

Explanation

Anchor text is arbitrary and often imitates a trusted brand, while the href attribute holds the URL the browser will actually request. Inspecting the raw source or hovering without clicking exposes that target. Styling and placement have no bearing on where the link resolves.

Question 7Phishing Analysis

A URL reads hxxps://[email protected]/session. Which host will the browser actually contact?

  1. secure-update-check.ru Correct answer.
  2. session
  3. login.contoso.com
  4. contoso.com

Explanation

In a URL, the userinfo section precedes an @ sign and everything after the @ is the real authority, so the browser connects to secure-update-check.ru. The text before the @ is ignored for routing and is placed there to look trustworthy. The path element session is not a host at all.

Question 8Phishing Analysis

During triage of a reported phishing email, which action should be taken first to limit potential harm?

  1. Wait for the user to confirm whether they clicked
  2. Delete the message only from the reporting user's mailbox
  3. Contain the message by quarantining it from other mailboxes Correct answer.
  4. Forward the message to all staff as a warning

Explanation

Containment comes first in incident response because the same message may sit in many inboxes and every minute of exposure increases the chance of a click. Once quarantined, the analyst can investigate safely. Warning others and cleaning a single mailbox are follow-up steps, not the initial action.

Question 9Phishing Analysis

An email claims an invoice is attached, but the attachment is named Invoice.pdf.exe. Which statement best describes the risk?

  1. The .exe extension marks it as a compressed archive
  2. The double extension hides an executable that runs code if opened Correct answer.
  3. The file cannot run because PDF is listed first
  4. The file is a harmless PDF with an extra naming label

Explanation

Windows resolves the final extension, so a file ending in .exe is an executable regardless of the decoy .pdf earlier in the name. Double extensions exploit the habit of reading only the first suffix. Opening such a file can execute attacker code on the host.

Question 10Phishing Analysis

A message contains a macro-enabled Word document. Why do attackers favour this delivery method?

  1. Macros can execute code when the user enables content Correct answer.
  2. Macros automatically verify the sender's SPF record
  3. Macros encrypt the document so scanners cannot read it
  4. Macros compress the file to bypass size limits

Explanation

Office macros are a scripting feature that can call system functions, so a document that persuades a user to enable editing content can download and run a payload. The social-engineering lure is what defeats the built-in warning. Encryption, sender verification and size reduction are unrelated to macro abuse.

Question 11Phishing Analysis

An analyst finds a URL containing %2e%2e%2f sequences. What technique is being used?

  1. DNS zone transfer
  2. Base64 encoding of the host
  3. Homoglyph domain substitution
  4. Percent-encoded path traversal Correct answer.

Explanation

Percent encoding represents reserved characters, and %2e is a dot while %2f is a slash, so the sequence decodes to ../ which attempts directory traversal. Attackers encode these characters to slip past naive filters and to obscure the real path. It is not an encoding of the host name or a character-substitution trick.

Question 12Phishing Analysis

A phishing page is hosted at paypal.com.account-verify.example. Which defensive concept does this URL exploit?

  1. Homograph attack using Cyrillic letters
  2. Use of an expired TLS certificate
  3. Typosquatting of a single character
  4. Subdomain impersonation of a trusted brand Correct answer.

Explanation

Because DNS labels are read right to left, the registrable domain here is account-verify.example and paypal.com is merely a subdomain label chosen to look convincing. Users often read left to right and mistake it for the brand. Typosquatting and homographs alter the domain characters themselves rather than placing a brand in a subdomain.

Question 13Phishing Analysis

What is the purpose of the DMARC aggregate report?

  1. To store copies of every delivered message body
  2. To record user complaints about spam
  3. To list the private DKIM keys used by the domain
  4. To summarise per-source authentication results for a domain Correct answer.

Explanation

Aggregate reports are XML summaries sent daily to the address in the rua tag, showing how many messages from each sending source passed or failed SPF and DKIM alignment. They help domain owners find unauthorised senders and misconfigured mail flows. They do not contain message bodies, keys or user complaints.

Question 14Phishing Analysis

An email passes SPF but fails DMARC alignment. What is the most likely explanation?

  1. The sender used a self-signed TLS certificate
  2. The sending IP is authorised for the envelope domain but not aligned with the From domain Correct answer.
  3. The receiving server has no DMARC record cached
  4. The message body was modified after the DKIM signature was applied

Explanation

DMARC requires that a passing SPF check use a domain aligned with the visible From header, so a pass on a different envelope domain still fails the policy. This is common with bulk senders and third-party mail services. Body modification would affect DKIM, and TLS certificates play no part in DMARC evaluation.

Question 15Phishing Analysis

Which characteristic most strongly suggests a credential-harvesting page rather than a legitimate login site?

  1. The page loads a company logo image
  2. The page uses HTTPS with a valid certificate
  3. The form posts credentials to an unrelated third-party domain Correct answer.
  4. The page is written in the local language

Explanation

The decisive indicator is where the submitted data goes: a login form that transmits credentials to a domain unrelated to the brand is harvesting them. HTTPS and logos are trivially available to attackers and prove nothing about legitimacy. Language localisation is likewise easy to copy.

Question 16Phishing Analysis

A user reports an email from the CEO asking for an urgent gift-card purchase and requesting secrecy. Which social-engineering levers are primarily in play?

  1. Malware delivered through a macro attachment
  2. Technical exploit of a browser vulnerability
  3. Authority and urgency combined with isolation Correct answer.
  4. Exploitation of a weak Wi-Fi encryption protocol

Explanation

Impersonating an executive invokes authority, the deadline creates urgency, and the request for secrecy isolates the target from colleagues who might question it. These are persuasion techniques rather than technical attacks. No attachment, vulnerability or network weakness is involved in this scenario.

Question 17Phishing Analysis

When examining raw email source, an analyst sees a Received header listing an internal hostname above a Received header from an external mail gateway. How should these be interpreted?

  1. The internal hostname proves the message originated inside the organisation
  2. Headers are read top-down, so the internal host sent directly to the internet
  3. Headers are read bottom-up, so the lower gateway entry occurred earlier Correct answer.
  4. The external gateway entry is always forged and should be ignored

Explanation

Each mail transfer agent prepends its own Received line, so the oldest hop appears at the bottom and the newest at the top. Reading from the bottom reconstructs the true path and timing. An internal-looking hostname in a top entry can be forged or injected by the sending system and does not prove internal origin.

Question 18Phishing Analysis

What does a DMARC sp= policy tag control?

  1. The signing algorithm used for DKIM
  2. The maximum message size accepted
  3. The policy applied to subdomains of the publishing domain Correct answer.
  4. The address that receives forensic reports

Explanation

The sp tag sets a separate policy for subdomains when the owner wants stricter or looser handling than the organisational domain policy. If sp is absent, subdomains inherit the p value. It has no connection to signing algorithms, reporting addresses or message size.

Question 19Phishing Analysis

An attacker registers a domain that differs from a target brand by swapping the letter l for the digit 1. Which term describes this?

  1. Header injection
  2. Typosquatting Correct answer.
  3. Open relay abuse
  4. Subdomain delegation

Explanation

Typosquatting registers domains that resemble a legitimate name through character substitutions, omissions or additions that users may overlook. The goal is to catch mistyped or misread addresses. It is distinct from mail relay misuse or header manipulation.

Question 20Phishing Analysis

An analyst reviewing a suspicious message notes that the From header shows [email protected] but the Return-Path shows [email protected]. What does this discrepancy most likely indicate?

  1. The message was encrypted in transit
  2. The message contains a DKIM signature
  3. The recipient's server rewrote the From address
  4. The envelope sender differs from the header sender, common with bulk or spoofed mail Correct answer.

Explanation

The Return-Path reflects the envelope sender used for delivery and bounces, while the From header is what the user sees. Legitimate bulk senders often use different envelope domains, and spoofers exploit the gap to pass SPF on a domain they control. The mismatch itself does not indicate encryption or header rewriting by the receiver.

Question 21Phishing Analysis

A phishing kit delivers a page that only renders the fake login form when the visitor's user agent matches a mobile browser, showing a blank page otherwise. What is the purpose of this behaviour?

  1. Evading automated sandbox and crawler analysis Correct answer.
  2. Complying with accessibility regulations
  3. Improving page load speed for real users
  4. Reducing bandwidth costs for the host

Explanation

Cloaking the malicious content behind a user-agent check means automated scanners that present desktop or headless agents see only a harmless page. Genuine victims on mobile devices still receive the credential form. The technique is about evasion, not performance or compliance.

Question 22Phishing Analysis

A message contains a URL with a long string of base64 characters in the query parameter. Why should an analyst decode it before concluding the link is benign?

  1. Encoded strings cannot be opened by browsers
  2. Query parameters are ignored by web servers
  3. Base64 encoding always indicates a virus signature
  4. Obfuscated parameters can conceal redirects or payload addresses Correct answer.

Explanation

Attackers encode parameters so that the visible URL does not reveal the final destination or embedded payload, and decoding often exposes a redirector or malicious host. The encoding itself is not proof of malware, but it warrants inspection. Browsers and servers do process query parameters normally.

Question 23Phishing Analysis

An organisation publishes DMARC with p=reject and strict alignment. A legitimate third-party service sends mail on its behalf but is not included in SPF and signs with its own DKIM domain. What is the likely outcome and correct fix?

  1. Messages fail only for internal users; disable DMARC for those users
  2. Messages pass because DKIM exists; no change is needed
  3. Messages pass because DMARC ignores third parties; no change is needed
  4. Messages fail alignment and are rejected; add the service to SPF or configure aligned DKIM Correct answer.

Explanation

Strict alignment requires the authenticated domain to match the From domain, so a third party signing with its own domain fails even though DKIM is valid. The remedy is to authorise the sender properly, either by adding its IPs to SPF or by having it sign with an aligned domain. Simply having any DKIM signature is insufficient.

Question 24Phishing Analysis

An analyst must safely examine a suspicious link without exposing the corporate network. Which approach best supports this?

  1. Open the link in the analyst's normal browser to check appearance
  2. Ask the reporting user to click and describe the result
  3. Send the link to a colleague to test on their workstation
  4. Resolve and fetch the URL from an isolated sandbox with no corporate access Correct answer.

Explanation

Isolation prevents the analyst's own host and the corporate network from being exposed to exploit kits, tracking or credential theft. A sandbox with no trust relationships lets the page be observed safely. Using production workstations or asking users to click reintroduces the very risk being investigated.

Question 25Phishing Analysis

An email passes DKIM verification but the DKIM d= domain differs from the From domain, and DMARC uses relaxed alignment. What can be concluded?

  1. The DKIM signature must be invalid
  2. The message is forged because the domains differ
  3. The message definitely satisfies DMARC because DKIM passed
  4. DKIM passes but may not satisfy DMARC alignment, so SPF alignment must also be checked Correct answer.

Explanation

Relaxed alignment still requires the organisational domain of the DKIM d= value to match the From domain, so a signature from an unrelated domain does not satisfy DMARC on its own. The analyst must also evaluate SPF alignment before deciding the overall DMARC result. A domain difference is not proof of forgery, and the signature is valid by premise.

Question 26Phishing Analysis

Which email header field identifies the mailbox to which a recipient's reply will be delivered when it differs from the From address?

  1. X-Mailer
  2. Reply-To Correct answer.
  3. Message-ID
  4. Content-Type

Explanation

The Reply-To header specifies an alternate address that the mail client inserts when the recipient replies. Attackers often set it to a lookalike or attacker-controlled mailbox so that replies never reach the genuine sender, which is a common sign of business email compromise attempts.

Question 27Phishing Analysis

A message's header shows Authentication-Results: spf=pass with the domain 'bounce.mailer.example' while the visible From domain is 'contoso.com'. Which conclusion is most defensible?

  1. SPF authenticated the envelope sender domain, so alignment with the From domain still needs checking Correct answer.
  2. SPF guarantees the message is legitimate because it passed
  3. The From header has been forged and the message must be malicious
  4. DKIM signing has failed and the message should be quarantined

Explanation

SPF checks the envelope sender (MAIL FROM or HELO) domain, not the visible From header. A pass therefore only proves that the sending IP was authorised for the domain SPF checked, and DMARC alignment must be evaluated separately to link that result to the From domain.

Question 28Phishing Analysis

Which record type must an analyst query to read a domain's published DMARC policy?

  1. A CNAME record at dmarc.<domain>
  2. An MX record at <domain>
  3. A SOA record at _dmarc.<domain>
  4. A TXT record at _dmarc.<domain> Correct answer.

Explanation

DMARC policies are published as TXT records on the subdomain _dmarc prefixed to the organisational domain, for example _dmarc.contoso.com. Analysts query that name to read tags such as p, rua and adkim rather than looking at mail exchanger or authority records.

Question 29Phishing Analysis

An analyst is asked to extract all URLs from a suspicious email body without opening it in a browser. Which approach best fits that requirement?

  1. Print the message to PDF and read the rendered hyperlinks
  2. Open the message in a webmail client with images enabled
  3. Forward the message to a colleague and ask them to click the links
  4. View the raw message source and collect href and plain-text URL strings Correct answer.

Explanation

Reading the raw source exposes the literal href values and any plain-text URLs exactly as sent, without rendering or fetching remote content. Rendering or forwarding can trigger tracking pixels or invite accidental clicks, so source inspection is the safer extraction method.

Question 30Phishing Analysis

A suspicious email includes a link whose visible text is 'www.contoso.com' but whose href value is 'http://203.0.113.45/login'. What does this discrepancy most directly indicate?

  1. The recipient's mail client has rewritten the URL
  2. The displayed text is decoupled from the actual link destination Correct answer.
  3. The message was signed with a valid DKIM key
  4. The domain contoso.com has expired

Explanation

HTML anchors separate the displayed text from the href attribute, so an attacker can show a trusted brand while pointing to an arbitrary host. Comparing the two in the raw source is a standard check that reveals the real destination.

Question 31Phishing Analysis

An analyst reviewing a message sees a Received header chain where the topmost entry names a host that does not resolve and shows a timestamp earlier than the entry beneath it. What is the most reasonable interpretation?

  1. The header chain has likely been forged or altered and should not be trusted for origin Correct answer.
  2. The timestamps prove the message was delayed in transit
  3. The message definitely originated from the recipient's own mail server
  4. The unresolvable host confirms the sender used a legitimate relay

Explanation

Received headers are added in order as a message travels, so each hop should appear above the previous one with a later timestamp. A top entry that predates the hop below it, or names an unresolvable host, suggests injected or edited headers and undermines origin claims.

Question 32Phishing Analysis

Which observable most strongly suggests that a landing page is a phishing kit rather than a genuine service login?

  1. The page loads a company logo image
  2. The page uses HTTPS with a valid certificate
  3. The page includes a password reset link
  4. The page posts credentials to a different domain than the one that served it Correct answer.

Explanation

A genuine login form submits credentials back to its own origin, whereas harvested credentials are typically posted to an attacker-controlled domain or a third-party form endpoint. Cross-origin form submission is therefore a strong indicator of credential theft.

Question 33Phishing Analysis

An analyst wants to determine whether a suspicious domain was registered recently. Which source of information is most appropriate?

  1. The message's Content-Transfer-Encoding header
  2. The domain's MX preference values
  3. WHOIS or RDAP registration data for the domain Correct answer.
  4. The recipient's local mail client address book

Explanation

WHOIS and its successor RDAP return registration dates, registrar and registrant details, which reveal domain age. Newly registered domains used for phishing typically show creation dates only days before the campaign.

Question 34Phishing Analysis

A phishing email contains an attachment named 'statement.htm' that, when opened, displays a fake Microsoft login form. Which technique does this represent?

  1. Macro execution inside a spreadsheet
  2. HTML smuggling of a credential-harvesting page via a local file Correct answer.
  3. Exploitation of a remote code execution vulnerability
  4. Delivery of a malicious LNK shortcut

Explanation

HTML attachments render locally in the browser and can host scripted fake login forms that submit credentials to a remote endpoint. Because no executable is delivered to disk, this technique often evades filters that focus on binaries.

Question 35Phishing Analysis

During analysis an analyst notices a URL parameter containing an email address that matches the recipient. What is the most likely purpose of that parameter?

  1. Tracking which recipient opened the link, possibly for targeting or victim identification Correct answer.
  2. Specifying the language of the landing page
  3. Encrypting the destination page content
  4. Providing a DKIM signature for the link

Explanation

Embedding the recipient's address in a URL lets the operator correlate clicks with a specific target, which supports campaign tracking and can personalise the fake page. Such identifiers also confirm to the attacker that the address is live and monitored.

Question 36Phishing Analysis

A message claims to be from a bank but the From display name is 'Security Team' while the address is '[email protected]'. Which check most efficiently confirms the mismatch with the genuine brand domain?

  1. Confirm the message was delivered to the inbox rather than spam
  2. Compare the address domain against the bank's known legitimate sending domains Correct answer.
  3. Verify that the message arrived during business hours
  4. Check whether the message contains a bank logo

Explanation

Display names are freely chosen and carry no authentication value, so the reliable check is the domain portion of the address against the brand's documented sending domains. Lookalike domains such as bank-secure.example are a hallmark of impersonation.

Question 37Phishing Analysis

An analyst observes that a phishing page returns a generic 404 error when the User-Agent header indicates a desktop security crawler but serves the fake login form to mobile browsers. What does this behaviour most likely indicate?

  1. The page is protected by a valid TLS certificate
  2. The server is misconfigured and cannot render HTML
  3. The domain has been sinkholed by the registrar
  4. The kit applies conditional serving to evade automated analysis Correct answer.

Explanation

Conditional content delivery based on User-Agent, IP reputation or referrer is a common anti-analysis feature in phishing kits. It hides the malicious page from sandboxes and crawlers while still presenting it to real victims.

Question 38Phishing Analysis

Which artefact best supports proving that a suspicious email was delivered to a specific user's mailbox at a given time?

  1. The HTML source of the phishing page
  2. The WHOIS record of the sender domain
  3. Message tracking logs from the receiving mail system Correct answer.
  4. The certificate chain of the sending server

Explanation

Mail server tracking logs record the message ID, recipients and delivery timestamps as processed by the receiving organisation. They provide the auditable timeline needed to scope which users received the message and when.

Question 39Phishing Analysis

An analyst must decide whether a suspected phishing message should be treated as a live incident rather than a blocked nuisance. Which finding most strongly justifies incident escalation?

  1. The sender domain was registered two years ago
  2. The message failed a single SPF check
  3. Several users already submitted credentials to the linked page Correct answer.
  4. The message contained a single embedded image

Explanation

Confirmed credential submission converts a delivery attempt into a compromise that requires password resets, session revocation and monitoring. Escalation is driven by evidence of successful interaction, not by cosmetic features or a lone authentication failure.

Question 40Phishing Analysis

An analyst is handed an email that passed SPF and DKIM for the domain 'mailrelay.example' while the From domain is 'contoso.com', and DMARC for contoso.com is p=reject with strict alignment. What is the expected DMARC outcome?

  1. The message passes DMARC because both SPF and DKIM succeeded
  2. The message fails DMARC because neither authenticated domain aligns with the From domain Correct answer.
  3. The message outcome cannot be determined without the recipient's user agent
  4. The message passes DMARC because p=reject only applies to the envelope domain

Explanation

DMARC requires at least one of SPF or DKIM to pass for a domain that aligns with the From domain. With strict alignment, mailrelay.example does not match contoso.com, so both results are disregarded and the message fails the published policy.

Question 41Threat Intelligence

In cyber threat intelligence, which term describes the highest level of the intelligence 'pyramid of pain', where disruption causes the most lasting cost to an adversary?

  1. File hashes
  2. Domain names
  3. Tactics, techniques and procedures Correct answer.
  4. IP addresses

Explanation

The pyramid of pain ranks indicators by how much difficulty an adversary faces when defenders deny them. TTPs sit at the apex because changing established behaviour is costly, whereas technical indicators such as hashes and IPs are cheap to alter.

Question 42Threat Intelligence

Which intelligence source type is produced from an organisation's own network telemetry, such as firewall logs and endpoint detections?

  1. Open-source intelligence
  2. Commercial threat feeds
  3. Internal telemetry Correct answer.
  4. Human intelligence

Explanation

Internal telemetry is first-party data generated by the organisation's own sensors and systems. It reflects what is actually happening inside the estate and is usually the most relevant source for detection and triage.

Question 43Threat Intelligence

What does the 'diamond model' of intrusion analysis use as its four core features?

  1. Indicator, context, confidence, timeliness
  2. Source, method, target, impact
  3. Adversary, capability, infrastructure, victim Correct answer.
  4. Actor, motive, opportunity, means

Explanation

The diamond model places adversary, capability, infrastructure and victim at the corners of a diamond, with events connecting them. Analysts use the relationships between these features to pivot and build a fuller picture of an intrusion.

Question 44Threat Intelligence

An analyst needs a structured, community-standard way to share indicators of compromise with partner organisations. Which specification is designed for this purpose?

  1. PCAP
  2. YARA
  3. Sigma
  4. STIX Correct answer.

Explanation

STIX is a structured language for expressing cyber threat information, including indicators, campaigns and threat actors, and is commonly paired with TAXII for transport. It is the standard choice for machine-readable indicator sharing.

Question 45Threat Intelligence

What is the primary purpose of the Traffic Light Protocol in threat intelligence sharing?

  1. To encrypt intelligence in transit between partners
  2. To signal the permitted sharing boundaries of information Correct answer.
  3. To rate the technical severity of a vulnerability
  4. To prioritise alerts by detection confidence

Explanation

Traffic Light Protocol markings communicate how widely a recipient may redistribute a piece of information. The colours define sharing limits, helping sources share sensitive material without uncontrolled onward distribution.

Question 46Threat Intelligence

Which of the following best describes 'tactical' threat intelligence?

  1. Board-level risk appetite statements
  2. Immediate indicators and TTPs used for detection and response Correct answer.
  3. Long-term strategic assessments of adversary intent
  4. Legislative and regulatory forecasts

Explanation

Tactical intelligence is short-lived and operationally focused, covering indicators and adversary behaviours that defenders can act on quickly. Strategic intelligence instead addresses longer-term trends and decision-making at senior level.

Question 47Threat Intelligence

A feed provides an indicator with no source, date or context. What is the most appropriate assessment of its intelligence value?

  1. Neutral, because context only matters for strategic reporting
  2. High, because uncontextualised data is unbiased
  3. Low, because context is needed to judge relevance and reliability Correct answer.
  4. High, because indicators are always actionable

Explanation

An indicator without provenance or context cannot be assessed for reliability, age or relevance to the environment. Raw data becomes intelligence only when enriched with context that supports a decision.

Question 48Threat Intelligence

Which of these is an example of an atomic indicator of compromise?

  1. A pattern of lateral movement across subnets
  2. A spear-phishing technique used against finance staff
  3. A specific malicious SHA-256 file hash Correct answer.
  4. A threat actor's long-term campaign goal

Explanation

Atomic indicators are discrete, observable values such as hashes, IP addresses and domain names. They can be matched directly by security tools, unlike broader behaviours or intent.

Question 49Threat Intelligence

An analyst receives a list of IP addresses observed as command-and-control servers. Which enrichment step most improves their operational usefulness?

  1. Deleting addresses older than one day without review
  2. Publishing them publicly without any marking
  3. Converting them all to hostnames
  4. Adding first-seen and last-seen dates plus geolocation and ASN Correct answer.

Explanation

Enriching indicators with timestamps, ownership and location data lets analysts judge freshness, relevance and likely infrastructure type. This context supports prioritisation and reduces wasted investigation effort.

Question 50Threat Intelligence

A vulnerability is being actively exploited in the wild, but no public exploit code exists. Which intelligence assessment is most accurate?

  1. Exploitation cannot be confirmed without published proof-of-concept code
  2. The vulnerability should be treated as lower priority because no exploit is public
  3. Active exploitation makes it a priority regardless of public exploit availability Correct answer.
  4. The vulnerability is only relevant to strategic reporting

Explanation

Observed exploitation in the wild is stronger evidence of risk than the mere absence of public exploit code. Defenders should prioritise patching and detection based on confirmed activity, not only on public tooling.