I85PREP
⌘ K
CTAS study materials
CTAS study resources

CTAS practice questions

One question at a time. Build your CTAS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Threat Intelligence Foundations and Requirements

In a threat intelligence program, which element belongs in the requirements phase rather than in the collection phase?

  1. Configuring feeds from open-source and commercial providers
  2. Ingesting indicators into a TIP platform
  3. Defining the priority intelligence requirements the organization must answer Correct answer.
  4. Normalizing timestamps across collected data sources

Explanation

Requirements define what decisions the intelligence must support and what questions must be answered before any collection begins. Collection, ingestion, and normalization are downstream activities that should be driven by those agreed requirements. Without a defined requirement, collection effort cannot be prioritized or measured.

Question 2Threat Intelligence Foundations and Requirements

Which statement best distinguishes threat intelligence from raw threat data?

  1. Intelligence is any data that has been stored in a structured database
  2. Intelligence is data collected exclusively from closed criminal forums
  3. Intelligence is data that has been analyzed and contextualized to support a decision Correct answer.
  4. Intelligence is a list of indicators with no further interpretation

Explanation

Threat intelligence is produced when data is processed, analyzed, and given context so that it can inform a specific decision. Raw indicators or logs are inputs, not finished intelligence. The value comes from relevance and interpretation, not from storage format or source exclusivity.

Question 3Threat Intelligence Foundations and Requirements

A security team needs to understand the strategic risk posed by a nation-state actor over the next year. Which intelligence level fits this need?

  1. Tactical intelligence
  2. Operational intelligence
  3. Technical intelligence
  4. Strategic intelligence Correct answer.

Explanation

Strategic intelligence addresses long-term trends, intent, and risk to the organization's mission, typically for senior leadership. Tactical and technical levels focus on immediate detection and response details. Operational intelligence sits between them, covering specific campaigns and actor operations.

Question 4Threat Intelligence Foundations and Requirements

Which is an example of a Priority Intelligence Requirement (PIR)?

  1. A statement of what decision-makers need to know about threats to a named business function Correct answer.
  2. A count of alerts generated by the SIEM each week
  3. A registry of all IP addresses observed in firewall logs
  4. A list of every CVE published in the last 30 days

Explanation

A PIR expresses a decision-relevant question tied to a business function or leadership concern. It guides collection and analysis toward answering that question. Raw CVE lists, alert counts, and log registries are data outputs, not requirements.

Question 5Threat Intelligence Foundations and Requirements

What does the 'intelligence cycle' describe?

  1. The sequence of firewall, IDS, and SIEM deployment steps
  2. The escalation path for a security incident response team
  3. The recurring process of planning, collection, processing, analysis, dissemination, and feedback Correct answer.
  4. The lifecycle of a software vulnerability from disclosure to patch

Explanation

The intelligence cycle is the iterative workflow that turns requirements into finished intelligence and then feeds lessons back into planning. Its stages include direction, collection, processing, analysis, dissemination, and feedback. The other options describe operational or product lifecycles, not the intelligence process.

Question 6Threat Intelligence Foundations and Requirements

Which source type is described as OSINT?

  1. Publicly available information such as government advisories, news, and social media Correct answer.
  2. Paid reports from a commercial threat intelligence vendor
  3. Information obtained from a confidential human source
  4. Telemetry from the organization's own endpoint agents

Explanation

OSINT is intelligence derived from publicly available information, including advisories, media, and public web content. Commercial vendor reports are a purchased source, internal telemetry is internal, and human sources are HUMINT. Source classification depends on where and how the information is obtained.

Question 7Threat Intelligence Foundations and Requirements

Why should intelligence requirements be reviewed and updated periodically?

  1. Because the business priorities and threat landscape they support change over time Correct answer.
  2. Because collection tools require weekly license renewal
  3. Because analysts must rotate responsibilities each quarter
  4. Because indicators expire after exactly 30 days

Explanation

Requirements exist to support decisions, so they must track changes in business priorities, leadership concerns, and the threat environment. A stale requirement wastes collection and analysis effort on questions nobody needs answered. Review cycles keep the program aligned with real needs.

Question 8Threat Intelligence Foundations and Requirements

What is the primary purpose of a threat intelligence platform (TIP) in the requirements-driven workflow?

  1. To replace the need for defined intelligence requirements
  2. To aggregate, normalize, and correlate intelligence while tracking how it answers requirements Correct answer.
  3. To automatically block all malicious traffic at the perimeter
  4. To generate strategic assessments without analyst involvement

Explanation

A TIP is an enabling technology that ingests and correlates intelligence so analysts can map it to requirements and disseminate it. It does not substitute for requirements or human analysis. Blocking traffic is an enforcement function performed by other controls.

Question 9Threat Intelligence Foundations and Requirements

An analyst receives a feed of malicious IP addresses. To turn this into intelligence for the network team, what should be added first?

  1. The geolocation of each address only
  2. Context such as the associated actor, campaign, confidence, and relevance to the organization Correct answer.
  3. A longer retention period for the raw feed
  4. A higher ingestion rate from the provider

Explanation

Raw indicators become actionable intelligence when enriched with context about who uses them, in what campaign, with what confidence, and whether they affect the organization's assets. Geolocation alone, retention, and ingestion speed do not create meaning. Context is what lets the network team prioritize.

Question 10Threat Intelligence Foundations and Requirements

A CISO asks how intelligence supports a decision on whether to fund additional endpoint detection. Which requirement type should the intelligence team use to frame the work?

  1. A strategic requirement tied to risk reduction for a business capability Correct answer.
  2. A technical requirement listing detection signatures
  3. An operational requirement for shift scheduling
  4. A tactical requirement focused on blocking known malware hashes

Explanation

Funding decisions are strategic, so the requirement must connect threat information to risk to a business capability. Tactical and technical requirements serve detection and response, and shift scheduling is not an intelligence requirement. Aligning the requirement type with the decision is essential.

Question 11Threat Intelligence Foundations and Requirements

Which pairing of intelligence consumer and product is most appropriate?

  1. Executive leadership receives a detailed list of YARA rules
  2. SOC analysts receive a five-year geopolitical forecast
  3. Vulnerability managers receive a list of foreign policy think tanks
  4. Incident responders receive indicators and TTP context for active hunting Correct answer.

Explanation

Products must match the consumer's decision space. Incident responders need actionable indicators and behavioral context to hunt and contain threats. Long forecasts suit leadership, rule lists suit detection engineers, and unrelated lists serve no consumer need.

Question 12Threat Intelligence Foundations and Requirements

A team writes a requirement: 'We need to know which ransomware groups are targeting our industry so we can prioritize backup hardening.' Which critique is most valid?

  1. It lacks a measurable decision, timeframe, and named industry scope Correct answer.
  2. It should be rewritten as a list of indicators
  3. It improperly references backup systems
  4. It is too specific and should be broadened to all cyber threats

Explanation

A well-formed requirement specifies the decision it supports, the scope, and a timeframe so success can be judged. This draft names a decision but leaves industry, time horizon, and how the answer will be used unstated. Broadening it or converting it to indicators would reduce its usefulness.

Question 13Threat Intelligence Foundations and Requirements

What role does feedback play at the end of the intelligence cycle?

  1. It transfers ownership of requirements to the tooling vendor
  2. It closes the loop by showing whether the intelligence answered the requirement and improving future cycles Correct answer.
  3. It marks the point where collection permanently stops
  4. It replaces the need for dissemination to consumers

Explanation

Feedback lets consumers confirm whether the product met their need and informs refinement of requirements and collection. It keeps the cycle iterative rather than a one-way pipeline. It does not end collection, replace dissemination, or outsource ownership.

Question 14Threat Intelligence Foundations and Requirements

An organization wants to detect adversary behavior rather than only known bad indicators. Which intelligence content best supports this requirement?

  1. A static list of expired domain names
  2. Descriptions of adversary tactics, techniques, and procedures mapped to a framework Correct answer.
  3. A count of blocked emails per week
  4. A list of patch release dates

Explanation

Behavior-based detection relies on understanding adversary TTPs, often mapped to a framework such as MITRE ATT&CK, so defenses can generalize to new tools. Static indicator lists and operational counts do not describe behavior. Patch dates are vulnerability management data.

Question 15Threat Intelligence Foundations and Requirements

Which practice best protects sensitive intelligence sources when disseminating a finished product?

  1. Applying marking, need-to-know handling, and source protection guidance Correct answer.
  2. Posting the product publicly to maximize awareness
  3. Sharing all raw source data by default
  4. Removing all context so the product cannot be traced

Explanation

Dissemination must balance utility with source protection using classification markings, need-to-know distribution, and handling instructions. Sharing raw data or stripping context can expose sources and reduce product value. Public posting is inappropriate for sensitive material.

Question 16Threat Intelligence Foundations and Requirements

A requirement asks: 'What threats could disrupt our new online payment launch in Q3?' Which collection approach is most directly aligned?

  1. Collecting general geopolitical news with no sector filter
  2. Reviewing historical firewall logs from five years ago
  3. Gathering unrelated malware samples from a public repository
  4. Monitoring adversary interest in the payment sector and related fraud TTPs ahead of the launch window Correct answer.

Explanation

Collection should be scoped to the requirement's subject, sector, and timeframe, here payment-sector threats before the Q3 launch. Unfiltered news, stale logs, and unrelated samples are not aligned to the question. Targeted collection improves relevance and timeliness.

Question 17Threat Intelligence Foundations and Requirements

Which statement about confidence levels in intelligence products is most accurate?

  1. Confidence should be based only on the number of indicators in the product
  2. Confidence is unnecessary when the source is a government advisory
  3. Confidence should reflect the reliability of sources and the strength of corroborating evidence Correct answer.
  4. Confidence should always be stated as 100 percent to reassure consumers

Explanation

Confidence communicates how much trust the analyst places in an assessment, based on source reliability and corroboration. Overstating confidence misleads decision-makers, and no source type guarantees certainty. Indicator counts alone are a poor basis for confidence.

Question 18Threat Intelligence Foundations and Requirements

A leadership requirement is stated at a level too broad to guide collection. What is the best first step for the intelligence team?

  1. Escalate directly to the vendor for a custom report
  2. Decompose the requirement into specific, answerable sub-questions with owners and timeframes Correct answer.
  3. Discard the requirement as unusable
  4. Begin collecting every available feed to cover all possibilities

Explanation

Broad requirements are refined through decomposition into specific intelligence questions that can be collected against and measured. Indiscriminate collection wastes resources, and discarding the requirement ignores a legitimate leadership need. Vendor escalation may follow but is not the first step.

Question 19Threat Intelligence Foundations and Requirements

Which is the clearest example of tactical threat intelligence?

  1. An assessment of the organization's overall cyber risk appetite
  2. A forecast of state-sponsored cyber competition over five years
  3. A report on a specific malware family's command-and-control domains and delivery lures Correct answer.
  4. A board-level briefing on industry threat trends

Explanation

Tactical intelligence provides the immediate, specific details needed to detect and respond, such as C2 infrastructure and delivery techniques. Multi-year forecasts, risk appetite assessments, and board trend briefings are strategic in nature. Specificity and immediacy distinguish the tactical level.

Question 20Threat Intelligence Foundations and Requirements

Why is defining the intended decision before setting a requirement important?

  1. It ensures all indicators will be perfectly accurate
  2. It removes the need for analyst judgment
  3. It determines the relevance, format, and timeliness criteria for the resulting intelligence Correct answer.
  4. It guarantees that collection tools will integrate with each other

Explanation

Knowing the decision tells the team what content matters, how fast it is needed, and in what form it should be delivered. It does not guarantee tool integration, eliminate judgment, or make indicators infallible. Decision-first framing is the foundation of useful requirements.

Question 21Threat Intelligence Foundations and Requirements

An analyst must judge whether a new requirement is worth resourcing. Which factor is least relevant to that judgment?

  1. The impact of the decision the intelligence would support
  2. The cost and effort of collection and analysis
  3. The popularity of the intelligence vendor's marketing campaign Correct answer.
  4. The feasibility of collecting the needed data

Explanation

Requirement prioritization weighs decision impact, collection feasibility, and cost. Marketing popularity is not a substantive criterion for whether intelligence answers a real need. Prioritization should be tied to value and practicality, not vendor promotion.

Question 22Threat Intelligence Foundations and Requirements

Two requirements compete for limited analyst time: one addresses a decision due in two weeks, the other a decision due next year. Which approach best reflects sound prioritization?

  1. Resource both equally regardless of deadlines
  2. Prioritize by decision impact and deadline, allocating effort to the near-term decision while planning for the longer one Correct answer.
  3. Always resource the longer-horizon requirement first because it is more strategic
  4. Defer both until additional analysts are hired

Explanation

Prioritization balances impact with timeliness, so a near-term decision with real consequences typically receives immediate effort while longer-horizon work is scheduled. Assuming long-horizon work is always more strategic is unfounded, and equal resourcing ignores deadlines. Deferring both leaves decisions unsupported.

Question 23Threat Intelligence Foundations and Requirements

A requirement calls for attribution of attacks to specific actors. Which consideration most affects whether this requirement is realistic?

  1. Whether the organization owns a large number of servers
  2. Whether the requirement was written by the SOC or the executive team
  3. Whether the organization has access to sufficient technical and contextual evidence and analytic expertise Correct answer.
  4. Whether the organization uses a particular brand of firewall

Explanation

Attribution demands diverse evidence, contextual knowledge, and skilled analysis, so feasibility depends on access to those resources. Server count, authorship, and firewall brand do not determine analytic feasibility. Setting realistic requirements requires honest assessment of capability.

Question 24Threat Intelligence Foundations and Requirements

An intelligence team produces accurate but unused reports. Which diagnosis best fits a requirements failure?

  1. The analysts used the wrong confidence vocabulary
  2. The collection feeds were insufficiently normalized
  3. The TIP lacked sufficient storage capacity
  4. The products were not mapped to the decisions and consumers who needed them Correct answer.

Explanation

Unused intelligence often signals a disconnect between products and the decisions or consumers they should serve, a requirements and dissemination problem. Normalization, confidence wording, and storage are technical issues that do not by themselves explain lack of use. Requirements should anchor products to real consumer needs.

Question 25Threat Intelligence Foundations and Requirements

Which scenario best illustrates the risk of collecting indicators without defined requirements?

  1. The team reviews a product with the consumer after dissemination
  2. The team maps a requirement to a specific collection source
  3. The team blocks a confirmed malicious domain tied to an active campaign
  4. The team accumulates large volumes of indicators but cannot say which threats matter to the business Correct answer.

Explanation

Without requirements, collection becomes volume-driven and the team cannot prioritize or explain relevance to the business. Blocking a confirmed domain, mapping requirements to sources, and post-dissemination review are all sound practices. The failure mode is effort without purpose.

Question 26Threat Intelligence Foundations and Requirements

An intelligence team needs to decide which external data providers to subscribe to for monitoring its sector. Which document should define the scope, priority, and collection sources before subscriptions are purchased?

  1. The finished intelligence product template
  2. The incident response runbook
  3. The intelligence requirements plan Correct answer.
  4. The vulnerability disclosure policy

Explanation

An intelligence requirements plan states the priority intelligence requirements, the decisions they support, and the collection sources and methods intended to satisfy them. It is the governing document that tells collectors what to acquire and why, so purchasing decisions flow from it rather than preceding it.

Question 27Threat Intelligence Foundations and Requirements

A requirement states that the team must understand adversary infrastructure used against peer organizations. Which collection discipline would primarily provide domain registration and certificate transparency data to satisfy it?

  1. HUMINT from internal employee interviews
  2. MASINT from network sensor telemetry
  3. TECHINT from captured adversary tooling
  4. OSINT from public registry and certificate logs Correct answer.

Explanation

Domain registration records and certificate transparency logs are publicly available data sources, which places them squarely in OSINT. They reveal infrastructure relationships without requiring access to adversary systems or internal human sources.

Question 28Threat Intelligence Foundations and Requirements

An analyst is drafting a priority intelligence requirement for a newly formed security operations center. Which formulation best meets the criteria for an actionable requirement?

  1. Understand the overall threat landscape affecting the company this year
  2. Identify which adversary techniques are most likely to evade our current endpoint controls next quarter Correct answer.
  3. Improve the maturity of the threat intelligence program across all business units
  4. Collect all available threat data about ransomware and review it regularly

Explanation

A sound requirement names a specific decision or knowledge gap, a defined subject, and a time horizon, which the endpoint-evasion option does. It also ties directly to a consumer who can act on the answer.

Question 29Threat Intelligence Foundations and Requirements

A business unit asks the intelligence team to assess supplier risk before a contract renewal. The team has no existing collection against that supplier's region. What is the most appropriate first action?

  1. Decline the request because no standing collection exists
  2. Add the supplier's domain to the blocklist and close the request
  3. Convert the request into a scoped requirement with a deadline and named consumer, then plan collection Correct answer.
  4. Deliver a report based on the team's general impressions of the region

Explanation

Ad hoc requests still need to be translated into a scoped requirement that states the question, the decision it supports, the deadline, and the consumer. Only then can the team choose sources and allocate collection effort proportionately.

Question 30Threat Intelligence Foundations and Requirements

A team's requirements are all phrased around strategic themes such as 'regional instability' and 'emerging technology trends'. Detection engineers report they receive nothing usable for tuning alerts. Which root cause best explains the gap?

  1. The requirements were approved by senior leadership rather than by the detection team
  2. The intelligence team is collecting from too many sources relative to its analyst headcount
  3. The detection engineers are not cleared to receive strategic intelligence products
  4. The requirements lack an operational level that maps to detectable adversary behavior and the decisions detection engineers make Correct answer.

Explanation

Requirements must be expressed at the level of the decision each consumer actually makes. Strategic themes cannot be translated into detection logic, so a parallel set of operational or tactical requirements tied to observable behavior is needed.

Question 31Threat Data Collection and Source Management

In a threat intelligence platform, which attribute best establishes that a collected indicator is current enough to support automated blocking?

  1. The indicator's confidence score
  2. The indicator's first-seen timestamp
  3. The indicator's malware family label
  4. The indicator's last-seen or expiration timestamp Correct answer.

Explanation

Freshness for automated blocking depends on when the indicator was last observed or when it is scheduled to expire, because stale indicators risk blocking legitimate infrastructure that has been reassigned. First-seen only marks the beginning of the observation window, while family labels and confidence scores describe context rather than recency.

Question 32Threat Data Collection and Source Management

A team wants to receive STIX 2.1 indicators from a partner in near real time rather than polling. Which collection method fits this requirement?

  1. Scheduled SFTP drop every 24 hours
  2. Email distribution list
  3. TAXII 2.1 collection subscription Correct answer.
  4. Manual CSV export on request

Explanation

TAXII 2.1 defines collections and channels that support both polling and push-style subscription of STIX content, which suits near real-time exchange. The other methods are batch or manual and cannot deliver continuous updates with the same latency.

Question 33Threat Data Collection and Source Management

When ingesting a feed of IP indicators, an analyst notices many entries are CDN edge addresses. What is the most appropriate handling action?

  1. Block them immediately at the perimeter firewall
  2. Report the feed provider to law enforcement
  3. Add them to a low-priority watchlist and suppress automated blocking Correct answer.
  4. Delete the entire feed as untrustworthy

Explanation

Shared CDN infrastructure is used by both benign and malicious traffic, so blocking it can cause widespread outages while the indicator may still have investigative value. Suppressing automated action and retaining the data for correlation is the proportionate response.

Question 34Threat Data Collection and Source Management

Which source type generally provides the highest contextual fidelity for attributing a campaign to a specific actor?

  1. A commercial aggregator's bulk IP blocklist
  2. A vendor research report with technical indicators and tradecraft analysis Correct answer.
  3. A DNS sinkhole log
  4. An open paste-site scrape

Explanation

Attribution requires analysis of tradecraft, infrastructure reuse, and targeting patterns, which curated research reports typically supply alongside indicators. Bulk blocklists and raw scrapes lack the narrative and cross-referencing needed to support attribution claims.

Question 35Threat Data Collection and Source Management

Under the Traffic Light Protocol 2.0, an indicator marked TLP:AMBER+STRICT may be shared with which parties?

  1. Only the recipient organization and its members
  2. Any trusted community partner worldwide
  3. Anyone, with no restriction
  4. The recipient organization only Correct answer.

Explanation

TLP:AMBER+STRICT limits sharing to the recipient organization itself, unlike plain AMBER which permits sharing within the recipient's community. This stricter designation exists to prevent onward distribution beyond the named organization.

Question 36Threat Data Collection and Source Management

An intelligence requirement asks whether a specific ransomware group is targeting the organization's sector. Which collection approach most directly addresses this requirement?

  1. Collecting generic phishing URL feeds
  2. Subscribing to a domain reputation API
  3. Reviewing firewall deny logs for the past week
  4. Monitoring sector-specific ISAC advisories and victim-post monitoring for that group Correct answer.

Explanation

Collection should be driven by the intelligence requirement, and sector advisories plus victim-post monitoring directly address whether the group is targeting that sector. Generic feeds and internal logs do not answer the targeting question on their own.

Question 37Threat Data Collection and Source Management

What is the primary purpose of assigning a confidence score to a finished intelligence product?

  1. To replace the need for source citations
  2. To indicate the product's classification level
  3. To measure how many sources were collected
  4. To communicate the analyst's degree of certainty in the judgment Correct answer.

Explanation

Confidence scoring conveys how much trust the analyst places in a judgment given source reliability and corroboration, so consumers can weigh it appropriately. It is distinct from classification and from raw source counts.

Question 38Threat Data Collection and Source Management

A feed provider's indicators repeatedly prove false positive in production. Which metric best captures this problem for source evaluation?

  1. Feed update frequency
  2. Feed average indicator length
  3. Feed precision, measured as true positives over total positives Correct answer.
  4. Feed total indicator count

Explanation

Precision measures the proportion of flagged indicators that are genuinely malicious, directly reflecting the false-positive burden. Frequency, volume, and string length do not express how often the feed's positives are correct.

Question 39Threat Data Collection and Source Management

Which practice best mitigates the risk of a single poisoned feed corrupting downstream detections?

  1. Ingesting every feed at equal weight
  2. Relying solely on the largest feed available
  3. Corroborating indicators across independent sources before high-impact use Correct answer.
  4. Removing all confidence metadata to simplify processing

Explanation

Requiring corroboration across independent sources reduces the chance that one compromised or low-quality feed drives blocking decisions. Equal weighting, metadata removal, and single-feed reliance all increase exposure to a poisoned source.

Question 40Threat Data Collection and Source Management

A STIX 2.1 Indicator object references a Malware object through which relationship type?

  1. targets
  2. indicates Correct answer.
  3. uses
  4. mitigates

Explanation

In STIX, an Indicator is linked to the Malware it detects with an 'indicates' relationship, expressing that the pattern indicates the malware. 'Targets', 'uses', and 'mitigates' describe other entity relationships such as threat actor to victim or tool to actor.

Question 41Threat Data Collection and Source Management

An organization wants to automate removal of indicators after they age out. Which data field should drive that automation?

  1. Malware family name
  2. Source provider name
  3. Indicator description text
  4. Valid-from and valid-until fields Correct answer.

Explanation

Validity windows define the period during which an indicator is considered applicable, so automation can retire it when valid-until passes. Descriptive fields and names carry no temporal semantics for expiration.

Question 42Threat Data Collection and Source Management

Which statement best describes the role of an ISAC in threat data collection?

  1. It facilitates sector-specific sharing of threat data among members Correct answer.
  2. It replaces an organization's internal SOC
  3. It sets international law on cyber operations
  4. It sells bulk telemetry to the highest bidder

Explanation

Information Sharing and Analysis Centers exist to collect and distribute sector-relevant threat information among trusted members, often under TLP handling rules. They do not set law, replace internal security operations, or function as purely commercial telemetry brokers.

Question 43Threat Data Collection and Source Management

An analyst receives a report with no source citations and vague indicators. What is the most defensible action?

  1. Ingest the indicators at high confidence
  2. Publish the indicators to partners without review
  3. Block all indicators immediately
  4. Treat the report as low-confidence and seek corroboration Correct answer.

Explanation

Uncited, vague reporting lacks the traceability needed for high-confidence use, so it should be treated cautiously and corroborated before action. Immediate blocking or onward publication would propagate unverified data.

Question 44Threat Data Collection and Source Management

A detection engineer wants to express an indicator as a portable pattern with a versioned language. Which specification is designed for this?

  1. Snort rule header
  2. STIX Patterning Correct answer.
  3. OpenIOC 1.1
  4. YARA-L rule syntax

Explanation

STIX Patterning provides a standardized, versioned language for expressing observable patterns within STIX Indicator objects. The others are vendor- or tool-specific rule formats rather than a general indicator pattern language tied to a sharing model.

Question 45Threat Data Collection and Source Management

When prioritizing between two feeds with similar content, which factor most supports choosing one over the other?

  1. The feed with the more colorful dashboard
  2. The feed with documented provenance and timely updates Correct answer.
  3. The feed with the lower subscription cost
  4. The feed with the larger raw volume

Explanation

Documented provenance and timely updates indicate a feed that is traceable and current, which supports trust and operational relevance. Volume, presentation, and cost are weaker proxies for quality.

Question 46Threat Data Collection and Source Management

Which collection source is most likely to provide early warning of a newly exploited vulnerability before a vendor advisory is published?

  1. A government compliance checklist
  2. An internal asset inventory
  3. Underground forum and paste-site monitoring Correct answer.
  4. The vendor's quarterly patch notes

Explanation

Underground and paste-site monitoring can surface exploit discussions or leaked details before official advisories, giving earlier warning. Patch notes, compliance lists, and asset inventories are internal or retrospective and lag emerging exploitation.

Question 47Threat Data Collection and Source Management

What is the main risk of ingesting indicators without normalizing formats such as IP notation and domain casing?

  1. Loss of TLP markings
  2. Increased storage cost only
  3. Duplicate or missed matches during correlation and blocking Correct answer.
  4. Reduced feed subscription cost

Explanation

Inconsistent representation causes the same indicator to appear as distinct values, producing duplicates and failed matches against telemetry. Normalization ensures consistent comparison and reliable blocking.

Question 48Threat Data Collection and Source Management

Which statement correctly pairs a source reliability rating with its meaning in intelligence handling?

  1. 'A' means the information is confirmed by three sources
  2. 'A' means the source has never been wrong historically
  3. 'A' means the source is highly reliable based on past performance Correct answer.
  4. 'A' means the source is anonymous

Explanation

In source reliability scales, 'A' denotes a highly reliable source judged on past performance, while information credibility is rated separately. It does not guarantee infallibility or describe anonymity.

Question 49Threat Data Collection and Source Management

An organization must share indicators with a partner under TLP:AMBER. What is the appropriate sharing constraint?

  1. Share publicly on a website
  2. Share only within the recipient's organization and its community as permitted Correct answer.
  3. Share with any third party without conditions
  4. Share only after removing all context

Explanation

TLP:AMBER permits sharing within the recipient's organization and, where the source allows, its community, but not public release. Public posting or unrestricted third-party sharing violates the marking.

Question 50Threat Data Collection and Source Management

Which factor most directly indicates that an indicator feed is operationally actionable for endpoint detection?

  1. It contains historical indicators from five years ago
  2. It contains file hashes and process behaviors mapped to detection logic Correct answer.
  3. It lists only country-level geolocation data
  4. It includes marketing summaries of vendor features

Explanation

Actionable endpoint indicators specify concrete artifacts such as hashes and behaviors that can be translated into detection logic. Geolocation, marketing text, and aged historical data lack the specificity or currency needed for endpoint action.