I85PREP
⌘ K
CTI study materials
CTI study resources

CTI practice questions

One question at a time. Build your CTI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Introduction to Threat Intelligence

Which statement best describes the primary purpose of cyber threat intelligence (CTI) in an organisation's security programme?

  1. To certify that an organisation complies with a regulatory framework
  2. To produce evidence-based knowledge about adversaries that informs defensive decisions Correct answer.
  3. To provide a complete inventory of every asset on the corporate network
  4. To replace the security operations centre with automated blocking tools

Explanation

Threat intelligence exists to turn raw data about adversaries into knowledge that supports concrete defensive choices, such as prioritising patching or tuning detections. It is decision support rather than an audit artefact or an asset inventory, and it never removes the need for human defenders.

Question 2Introduction to Threat Intelligence

In the intelligence cycle, which activity immediately follows the 'direction' (requirements-setting) phase?

  1. Feedback
  2. Collection Correct answer.
  3. Dissemination
  4. Analysis

Explanation

The cycle begins with direction, where decision-makers define priority intelligence requirements, and then moves to collection of data that can satisfy those requirements. Analysis only happens once data has been gathered, and dissemination comes after analysis.

Question 3Introduction to Threat Intelligence

A security team receives a list of IP addresses observed hosting command-and-control servers. Which term best classifies this material on its own?

  1. Finished strategic intelligence
  2. Technical data at the lowest level of the intelligence hierarchy Correct answer.
  3. An estimate of future adversary capability
  4. A tactical report on adversary intent

Explanation

Indicators such as IP addresses and hashes are atomic technical data, the raw bottom layer of the data-information-knowledge-wisdom hierarchy. On their own they carry no context about intent, capability, or likely future action.

Question 4Introduction to Threat Intelligence

Which pairing correctly distinguishes tactical intelligence from strategic intelligence?

  1. Tactical is produced only by governments; strategic is produced only by commercial vendors
  2. Tactical describes geopolitics; strategic describes malware signatures
  3. Tactical addresses immediate adversary techniques and indicators; strategic addresses long-term risk and intent Correct answer.
  4. Tactical is always classified; strategic is always publicly shared

Explanation

Tactical intelligence supports short-term defensive action against specific tools and techniques, while strategic intelligence informs longer-horizon decisions about adversary intent and organisational risk. The distinction is about time horizon and consumer, not about who produces it or its classification.

Question 5Introduction to Threat Intelligence

What distinguishes an intelligence 'requirement' from a general security question?

  1. It is a request that must always be answered from open-source data
  2. It is a specific, prioritised question tied to a decision the organisation must make Correct answer.
  3. It is a formal legal demand issued by a regulator
  4. It is any question that an analyst finds personally interesting

Explanation

A requirement is a prioritised question derived from a decision-maker's needs, so that collection and analysis can be focused and measurable. Without a link to a decision, an interesting question cannot guide resource allocation.

Question 6Introduction to Threat Intelligence

Which source type is described by the term OSINT?

  1. Reports exchanged between national intelligence agencies
  2. Data purchased from a commercial feed under a non-disclosure agreement
  3. Traffic captured from an adversary's private command-and-control infrastructure
  4. Information lawfully gathered from publicly available sources such as websites, registries, and media Correct answer.

Explanation

OSINT refers to intelligence derived from publicly accessible information, collected and analysed lawfully. Its defining feature is public availability, not the tooling used to gather it.

Question 7Introduction to Threat Intelligence

An analyst receives a feed of malware hashes with no context and wants to judge whether they are relevant to the organisation. Which step best applies the intelligence cycle to this problem?

  1. Publish the hashes to the public internet for community validation
  2. Block every hash immediately without further review
  3. Discard the feed because hashes are low-fidelity data
  4. Identify which systems and sectors the hashes affect, then prioritise those matching the organisation's exposure Correct answer.

Explanation

Applying context to raw indicators is the processing and analysis stage, and relevance is judged against the organisation's own exposure and requirements. Blind blocking may create operational risk, and discarding useful data wastes collection effort.

Question 8Introduction to Threat Intelligence

A vendor feed rates an indicator as high confidence. What does this rating most properly describe?

  1. The number of sensors that have observed the indicator
  2. The severity of damage if the indicator is blocked
  3. The vendor's assessed reliability that the indicator is accurate and correctly attributed Correct answer.
  4. The legal jurisdiction in which the indicator was collected

Explanation

Confidence expresses the producer's assessed reliability of the judgement, based on source quality and corroboration. It is distinct from impact or severity, which describe consequences rather than certainty.

Question 9Introduction to Threat Intelligence

Which scenario best illustrates the difference between data and intelligence?

  1. A log of 10,000 login failures is intelligence because it was collected by a SIEM
  2. A vulnerability scan report is intelligence because it lists CVEs
  3. A threat feed is intelligence because it was purchased commercially
  4. A log of 10,000 login failures becomes intelligence when analysed to show a targeted password-spraying campaign against finance staff Correct answer.

Explanation

Data becomes intelligence once it is processed and analysed to reveal meaning that supports a decision, such as identifying a targeted campaign. Collection tooling or purchase price alone does not confer that status.

Question 10Introduction to Threat Intelligence

An organisation wants intelligence to support a board-level decision on cyber insurance limits. Which intelligence product is most appropriate?

  1. A YARA rule set for detecting a specific malware family
  2. A list of recently observed phishing domains
  3. A strategic assessment of likely adversary targeting and potential business impact Correct answer.
  4. A feed of file hashes from a malware sandbox

Explanation

Board decisions about risk transfer require strategic intelligence that frames likelihood and business impact over time. Technical artefacts such as rules, domains, and hashes serve operational detection rather than executive risk decisions.

Question 11Introduction to Threat Intelligence

Which practice most improves the trustworthiness of an intelligence assessment built from a single vendor report?

  1. Publishing the assessment before any peer review to save time
  2. Removing all source references so the report reads cleanly
  3. Treating vendor reputation as a substitute for corroboration
  4. Corroborating the key claims with independent sources and recording the confidence level Correct answer.

Explanation

Corroboration across independent sources and explicit confidence statements are core analytic standards that reduce reliance on any single provider. Source transparency also lets consumers judge the assessment for themselves.

Question 12Introduction to Threat Intelligence

What is the main purpose of the MITRE ATT&CK framework when used in threat intelligence?

  1. To provide a legally binding sharing agreement between organisations
  2. To score the business criticality of internal assets
  3. To replace antivirus signatures with behavioural rules automatically
  4. To structure observed adversary behaviour into a common taxonomy of tactics and techniques Correct answer.

Explanation

ATT&CK offers a shared vocabulary of tactics and techniques so that intelligence about adversary behaviour can be compared, mapped, and used to find detection gaps. It does not assess asset criticality or create legal agreements.

Question 13Introduction to Threat Intelligence

An analyst maps an intrusion report to ATT&CK and finds the organisation has no detection coverage for several techniques used. What is the most valuable intelligence output from this finding?

  1. A public blog post naming the victim organisation
  2. A prioritised list of detection gaps tied to techniques the adversary actually used Correct answer.
  3. A recommendation to purchase a new endpoint product immediately
  4. A decision to stop collecting endpoint telemetry

Explanation

Mapping observed behaviour to defensive coverage turns intelligence into actionable gap analysis, letting defenders prioritise the techniques most relevant to them. Buying tools or disclosing victims does not follow directly from the coverage finding.

Question 14Introduction to Threat Intelligence

Which statement correctly describes the Traffic Light Protocol (TLP) in intelligence sharing?

  1. It certifies that a source is free of bias
  2. It ranks indicators by technical severity
  3. It encrypts the contents of a shared report automatically
  4. It signals the sharing boundaries a recipient must respect for the information received Correct answer.

Explanation

TLP is a set of markings that tells recipients how far, and to whom, they may redistribute information. It governs dissemination rather than encryption, severity scoring, or source quality.

Question 15Introduction to Threat Intelligence

A team receives a TLP:RED report and wants to discuss it with a trusted peer at a partner company. What does the marking require?

  1. The information must not be shared beyond the named recipients of the original exchange Correct answer.
  2. The information may be shared freely within the partner's whole organisation
  3. The information may be posted to a closed industry forum
  4. The information may be published once anonymised

Explanation

TLP:RED restricts dissemination to the individuals present in the original exchange, so widening the audience even to a trusted partner breaches the marking. Recipients who need to share must seek the source's permission first.

Question 16Introduction to Threat Intelligence

Which analytic pitfall is illustrated by an analyst who assumes an intrusion is the work of a known group solely because the malware resembles that group's tooling?

  1. Corroborating the finding with independent telemetry
  2. Establishing a confidence level for the attribution
  3. Applying structured competing-hypothesis analysis
  4. Mirror-imaging adversary identity from shared tooling Correct answer.

Explanation

Shared tools are widely leaked, sold, and reused, so tooling similarity alone cannot establish identity; treating it as proof is a form of mirror-imaging or premature attribution. Sound practice weighs alternative hypotheses and states confidence explicitly.

Question 17Introduction to Threat Intelligence

An organisation must choose between two intelligence sources: one is timely but unverified, the other is slower but corroborated. Which principle should guide the choice?

  1. Always choose the slowest source because delay guarantees accuracy
  2. Choose whichever source is cheaper to license
  3. Weigh the decision's time sensitivity against the cost of acting on an unverified assessment Correct answer.
  4. Always choose the fastest source regardless of reliability

Explanation

Intelligence supports decisions, so the appropriate trade-off depends on how quickly a decision is needed and how damaging a wrong assessment would be. Neither speed nor delay is inherently correct, and licence cost is not an analytic criterion.

Question 18Introduction to Threat Intelligence

A report states that an actor 'will likely' target a sector within six months. Which element is essential for a consumer to interpret this judgement responsibly?

  1. A guarantee that the prediction will occur
  2. An explicit statement of the analytic confidence behind the likelihood Correct answer.
  3. The full raw packet capture that supported the report
  4. The identity of the analyst who wrote the sentence

Explanation

Probability language in intelligence is only meaningful when paired with an explicit confidence level, so consumers can weigh the judgement against their risk tolerance. Predictions are estimates, not guarantees, and raw captures are rarely needed or shareable.

Question 19Introduction to Threat Intelligence

Which activity best demonstrates converting intelligence into a measurable defensive outcome?

  1. Increasing the number of intelligence vendors under contract
  2. Updating detection rules and tracking the reduction in successful adversary techniques observed Correct answer.
  3. Adding more indicators to a feed without changing any detection logic
  4. Storing reports in a shared drive for future reference

Explanation

Intelligence creates value when it changes defensive posture and the effect can be measured, such as fewer successful techniques or faster detection. Volume of indicators, stored reports, or vendor count are inputs, not outcomes.

Question 20Introduction to Threat Intelligence

Which of the following best explains why threat intelligence is described as a cycle rather than a linear process?

  1. Analysts repeat collection until they run out of data
  2. Each phase must be completed once and then permanently closed
  3. Feedback from consumers continuously reshapes the requirements that drive the next round of collection Correct answer.
  4. The cycle is linear but renamed to sound more rigorous

Explanation

Consumer feedback refines requirements, so direction, collection, and analysis are revisited iteratively as needs and the threat landscape change. Treating phases as permanently closed would make the product stale.

Question 21Threat Intelligence Types and Sources

Which intelligence type describes technical indicators such as IP addresses, domain names, and file hashes that can be used directly in detection systems?

  1. Tactical threat intelligence
  2. Strategic threat intelligence
  3. Operational threat intelligence
  4. Technical threat intelligence Correct answer.

Explanation

Technical threat intelligence focuses on machine-readable artifacts such as IPs, domains, URLs, and hashes that feed detection tools like SIEM and IDS. It is distinguished from the other types by its low-level, indicator-centric nature. Strategic intelligence addresses long-term business risk, while operational intelligence concerns adversary campaigns and intent.

Question 22Threat Intelligence Types and Sources

A CISO needs a report that explains how a nation-state group's long-term targeting of the company's industry could affect business strategy over the next year. Which intelligence type best fits this need?

  1. Strategic intelligence Correct answer.
  2. Tactical intelligence
  3. Atomic indicator feeds
  4. Technical intelligence

Explanation

Strategic threat intelligence is produced for decision-makers and connects adversary activity to business risk, trends, and long-term planning. It is consumed by executives rather than by detection tooling. Technical and tactical intelligence are too granular for this audience and purpose.

Question 23Threat Intelligence Types and Sources

Which source is considered open-source intelligence (OSINT) in a threat intelligence program?

  1. A paid commercial malware analysis subscription
  2. A public vulnerability database such as the NVD Correct answer.
  3. Telemetry collected from the organization's own endpoint agents
  4. A private law enforcement bulletin shared under an information-sharing agreement

Explanation

OSINT is derived from publicly available information, and a public vulnerability database like the NVD is freely accessible to anyone. Commercial subscriptions, restricted sharing arrangements, and internal telemetry are not open sources. The distinguishing factor is public availability, not cost or usefulness.

Question 24Threat Intelligence Types and Sources

What distinguishes HUMINT from other threat intelligence collection disciplines?

  1. It is produced by automated scraping of public web content
  2. It is derived exclusively from network traffic captures and packet analysis
  3. It is gathered from human sources such as informants, interviews, and undercover reporting Correct answer.
  4. It is generated by correlating vulnerability scan results across hosts

Explanation

HUMINT refers to intelligence collected through human interaction, including interviews, informants, and debriefings. It is distinct from technical collection methods such as traffic capture or web scraping. Its value lies in context and intent that automated collection often misses.

Question 25Threat Intelligence Types and Sources

An analyst receives indicators from a vendor feed and wants to enrich them with context about the adversary's motivations and typical targeting. Which intelligence type should the analyst consult?

  1. Vulnerability intelligence
  2. Strategic intelligence
  3. Operational intelligence Correct answer.
  4. Technical intelligence

Explanation

Operational intelligence provides context about specific adversary campaigns, including intent, timing, and targeting, which complements raw indicators. Technical intelligence alone does not explain adversary motivation or targeting patterns. Strategic intelligence addresses broader business risk rather than campaign-level context.

Question 26Threat Intelligence Types and Sources

Which statement best describes the purpose of the Traffic Light Protocol (TLP) in intelligence sharing?

  1. It specifies the technical format for exchanging indicators between tools
  2. It ranks indicators by confidence level for automated blocking
  3. It indicates the sharing restrictions and handling caveats for a piece of information Correct answer.
  4. It defines how long indicators should be retained before deletion

Explanation

TLP is a marking scheme that communicates how widely information may be shared and with whom. It does not prescribe formats, retention periods, or indicator confidence. Analysts apply TLP markings to inform recipients of handling restrictions.

Question 27Threat Intelligence Types and Sources

Which standard is designed to structure and exchange cyber threat intelligence in a machine-readable form?

  1. Snort
  2. YARA
  3. STIX Correct answer.
  4. OpenIOC

Explanation

STIX is a structured language for representing cyber threat intelligence so it can be shared and processed automatically, typically transported via TAXII. YARA and Snort are detection rule languages, and OpenIOC is a legacy indicator format, not a full intelligence representation standard.

Question 28Threat Intelligence Types and Sources

A SOC analyst notices that an indicator feed contains an IP address that belongs to a shared content delivery network used by many benign services. What is the primary risk of blocking it outright?

  1. The feed will automatically revoke the indicator
  2. The IP address will change to a domain name
  3. The block may cause false positives by disrupting legitimate traffic Correct answer.
  4. The indicator will expire before the block is applied

Explanation

Indicators on shared infrastructure such as CDNs can be associated with both malicious and benign activity, so blocking them risks disrupting legitimate services. This is a common false-positive concern when consuming technical intelligence. Analysts should validate context before enforcing blocks.

Question 29Threat Intelligence Types and Sources

Which characteristic most strongly suggests that a threat intelligence source is of high quality?

  1. It labels every indicator as high severity
  2. It documents its collection methodology and provides confidence assessments Correct answer.
  3. It is available only through a paid subscription
  4. It publishes a large volume of indicators daily

Explanation

Transparency about collection methods and the inclusion of confidence or assessment context are hallmarks of reliable intelligence sources. Volume alone does not indicate quality and can increase noise. Paid access and blanket high-severity labels are not indicators of rigor.

Question 30Threat Intelligence Types and Sources

Which intelligence type is most directly consumed by a threat hunter developing hypotheses about adversary behavior on endpoints?

  1. Financial intelligence
  2. Strategic threat intelligence
  3. Policy intelligence
  4. Tactical threat intelligence Correct answer.

Explanation

Tactical intelligence describes adversary tactics, techniques, and procedures, which hunters use to form hypotheses and design detection queries. Strategic intelligence is too high-level for endpoint hunting. Financial and policy intelligence are not standard CTI types and do not guide hunting hypotheses.

Question 31Threat Intelligence Types and Sources

An organization wants to automate the retrieval of STIX-formatted intelligence from a sharing community. Which protocol is designed for this purpose?

  1. SMTP
  2. DNS over HTTPS
  3. TAXII Correct answer.
  4. Syslog

Explanation

TAXII is a transport protocol designed to exchange cyber threat intelligence, commonly carrying STIX content between producers and consumers. DNS over HTTPS, SMTP, and Syslog are general-purpose protocols not built for structured intelligence exchange.

Question 32Threat Intelligence Types and Sources

What is the primary purpose of a threat intelligence platform (TIP) in an intelligence program?

  1. To encrypt intelligence feeds during storage
  2. To replace endpoint detection and response tools
  3. To aggregate, normalize, and correlate intelligence from multiple sources Correct answer.
  4. To scan networks for unpatched vulnerabilities

Explanation

A TIP ingests intelligence from many sources, normalizes formats, deduplicates, and correlates data to support analysis and dissemination. It complements rather than replaces detection tools. Network scanning and storage encryption are separate functions not central to a TIP's purpose.

Question 33Threat Intelligence Types and Sources

A vendor feed marks an indicator with high confidence, but the indicator is six months old and tied to infrastructure that has since been reassigned. How should the analyst treat it?

  1. Escalate it as a strategic intelligence finding
  2. Block it immediately because confidence is high
  3. Discard it permanently because of its age
  4. Validate current context before using it for detection Correct answer.

Explanation

Indicator confidence and age must be evaluated together with current context, since infrastructure can be reassigned to benign owners over time. High confidence does not guarantee present-day validity. Validation prevents false positives from stale indicators.

Question 34Threat Intelligence Types and Sources

Which of the following is an example of closed-source threat intelligence?

  1. A proprietary feed available only to paying subscribers Correct answer.
  2. A community forum thread discussing an attack
  3. A public blog post describing a malware family
  4. A government-published advisory on a vulnerability

Explanation

Closed-source intelligence is restricted to a defined audience, such as paying subscribers or vetted members. Public blog posts, government advisories, and community forums are openly accessible and therefore open-source. Access restriction, not content, defines the closed classification.

Question 35Threat Intelligence Types and Sources

Which collection discipline relies on intercepted communications and electronic emissions rather than human sources?

  1. SIGINT Correct answer.
  2. OSINT
  3. IMINT
  4. HUMINT

Explanation

SIGINT, or signals intelligence, is derived from intercepted communications and electronic signals. HUMINT relies on human sources, OSINT on public information, and IMINT on imagery. The distinction rests on the collection medium.

Question 36Threat Intelligence Types and Sources

Why is first-party telemetry valuable in a threat intelligence program?

  1. It provides organization-specific context that external feeds cannot Correct answer.
  2. It guarantees compliance with sharing regulations
  3. It eliminates the need for any external intelligence sources
  4. It is always more accurate than vendor-provided indicators

Explanation

First-party telemetry reflects the organization's own environment, assets, and observed activity, giving context that generic external feeds lack. It complements rather than replaces external intelligence. It is not inherently more accurate than vetted vendor data, and it does not guarantee regulatory compliance.

Question 37Threat Intelligence Types and Sources

An analyst wants to compare an observed malware hash against a public repository of known samples. Which type of source is this?

  1. A closed commercial intelligence feed
  2. An open malware sample repository Correct answer.
  3. A strategic intelligence report
  4. A human-source debriefing

Explanation

Public malware sample repositories are openly accessible and are a form of open-source intelligence for technical analysis. They are not closed commercial feeds, strategic reports, or human-source collection. Analysts use them to confirm and enrich indicators.

Question 38Threat Intelligence Types and Sources

Which factor is most important when deciding whether to share an intelligence report with a partner organization?

  1. The length of the report
  2. The number of indicators it contains
  3. The publishing date of the report
  4. The handling restrictions and source protections attached to the information Correct answer.

Explanation

Sharing decisions must respect handling caveats, source-protection obligations, and any TLP or contractual restrictions attached to the intelligence. Length, indicator count, and publication date do not determine sharing eligibility. Violating source protections can damage trust and future collection.

Question 39Threat Intelligence Types and Sources

Which statement accurately distinguishes strategic intelligence from operational intelligence?

  1. Strategic intelligence is machine-readable, while operational intelligence is always written prose
  2. Strategic intelligence is only produced by governments, while operational intelligence is only produced by vendors
  3. Strategic intelligence contains indicators, while operational intelligence contains only vulnerabilities
  4. Strategic intelligence addresses long-term risk and planning, while operational intelligence addresses specific campaigns and adversary intent Correct answer.

Explanation

Strategic intelligence supports long-term decision-making about risk and resource allocation, while operational intelligence describes specific adversary campaigns, their intent, and timing. Both can be produced by governments and vendors and are not defined by format. Indicators are characteristic of technical intelligence.

Question 40Threat Intelligence Types and Sources

A feed provides indicators with no metadata about collection source, confidence, or first-seen date. What is the most defensible analytic conclusion about this feed?

  1. It is unsuitable for automated enforcement without further validation Correct answer.
  2. It must be a government source because it lacks commercial branding
  3. It should be used only for strategic planning
  4. It is high quality because it is concise

Explanation

The absence of provenance, confidence, and timestamps makes it impossible to judge indicator reliability or freshness, so automated enforcement would be risky. Concise formatting is not evidence of quality. Lack of branding does not imply government origin, and such data is too granular for strategic planning.

Question 41Threat Intelligence Types and Sources

An organization participates in a sector information-sharing and analysis center (ISAC). What is the primary benefit of this membership for threat intelligence?

  1. Legal authority to conduct offensive operations
  2. Guaranteed immunity from attacks targeting the sector
  3. Automatic replacement of internal security controls
  4. Access to peer-shared, sector-relevant threat information and indicators Correct answer.

Explanation

ISACs facilitate sharing of threat information among organizations in the same sector, giving members peer-derived, contextually relevant intelligence. Membership does not confer immunity, replace controls, or authorize offensive action. The value lies in collective sharing and early warning.

Question 42Threat Intelligence Types and Sources

An analyst must choose between a free OSINT feed with frequent updates and a paid feed with documented methodology and confidence scoring. Which reasoning best supports the choice?

  1. Choose the free feed because update frequency is the only relevant criterion
  2. Choose neither, because all feeds are equally unreliable
  3. Always choose the free feed because cost indicates bias
  4. Choose the paid feed because documented methodology and confidence enable better risk decisions Correct answer.

Explanation

Documented methodology and confidence scoring allow analysts to weigh reliability and make defensible risk decisions, which is a core criterion for source selection. Cost alone does not indicate bias, and update frequency is only one factor. Dismissing all feeds ignores the value of vetted sources.

Question 43Threat Intelligence Types and Sources

Which practice best mitigates the risk of acting on a false-positive indicator from an external feed?

  1. Ignoring all external indicators
  2. Blocking all indicators immediately upon ingestion
  3. Deleting the indicator after one week
  4. Correlating the indicator with internal telemetry before enforcement Correct answer.

Explanation

Correlating external indicators with internal telemetry confirms whether the indicator is actually relevant to the environment before enforcement. Immediate blocking increases disruption risk, while ignoring or arbitrarily deleting indicators sacrifices potential value. Validation is the core mitigation.

Question 44Threat Intelligence Types and Sources

Which source type provides vulnerability details, severity scoring, and affected product information used to prioritize patching?

  1. A vulnerability intelligence source such as a CVE database Correct answer.
  2. A malware sandbox report
  3. A brand monitoring service
  4. A phishing takedown feed

Explanation

Vulnerability intelligence sources such as CVE databases provide flaw details, severity scores, and affected products that support patch prioritization. Sandbox reports describe malware behavior, brand monitoring tracks impersonation, and takedown feeds address phishing infrastructure. Each serves a different intelligence purpose.

Question 45Threat Intelligence Frameworks and Standards

In STIX 2.1, which object is used to group related STIX objects into a bundle-like container that conveys a shared context such as a campaign or report?

  1. Observed-Data
  2. Grouping Correct answer.
  3. Indicator
  4. Identity

Explanation

STIX 2.1 defines the Grouping object specifically to assert that a set of referenced objects share a common context, such as an incident investigation. It uses a context field and a list of object_refs rather than embedding the objects. Bundles, by contrast, are transport containers with no analytical meaning.

Question 46Threat Intelligence Frameworks and Standards

Which TAXII 2.1 service is used by a client to discover which collections it is permitted to read?

  1. The Status endpoint
  2. The Collections endpoint
  3. The Discovery endpoint Correct answer.
  4. The Objects endpoint

Explanation

The TAXII Discovery endpoint returns information about the server, including the API roots and the collections available to the authenticated client. Clients call it first to learn where they can subscribe. Collection and object endpoints are then queried within a specific API root.

Question 47Threat Intelligence Frameworks and Standards

In the Cyber Kill Chain model, which phase immediately follows 'Weaponization'?

  1. Exploitation
  2. Delivery Correct answer.
  3. Reconnaissance
  4. Command and Control

Explanation

The Lockheed Martin kill chain orders phases as Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Delivery transmits the weaponized payload to the target, so it directly follows Weaponization. Reconnaissance precedes Weaponization, not follows it.

Question 48Threat Intelligence Frameworks and Standards

Which component of the Diamond Model represents the infrastructure used to conduct an intrusion event?

  1. Capability
  2. Infrastructure Correct answer.
  3. Victim
  4. Adversary

Explanation

The Diamond Model has four vertices: adversary, capability, infrastructure, and victim. Infrastructure covers the physical and logical resources, such as servers, domains, and IP addresses, that the adversary uses to deliver a capability. Capability refers to the tools and malware themselves.

Question 49Threat Intelligence Frameworks and Standards

In the MITRE ATT&CK Enterprise matrix, what does a 'Technique' represent?

  1. A defensive control that mitigates an attack
  2. A general category of adversary behavior describing how a goal is achieved Correct answer.
  3. A vulnerability identifier from a CVE database
  4. A specific piece of malware attributed to a named group

Explanation

ATT&CK techniques describe how adversaries achieve tactical goals, such as credential dumping or spearphishing. They are organized under tactics and may have sub-techniques. They are behavior descriptions, not malware samples, controls, or CVE records.

Question 50Threat Intelligence Frameworks and Standards

What is the primary purpose of the Traffic Light Protocol (TLP) in threat intelligence sharing?

  1. To indicate the sharing boundaries for information Correct answer.
  2. To rank indicators by confidence score
  3. To classify malware by family
  4. To encrypt shared intelligence in transit

Explanation

TLP uses color markings (CLEAR, GREEN, AMBER, AMBER+STRICT, RED) to tell recipients how far information may be shared. It is a handling caveat, not an encryption or scoring mechanism. The FIRST TLP 2.0 standard defines the current markings.