I85PREP
⌘ K
CTSP study materials
CTSP study resources

CTSP practice questions

One question at a time. Build your CTSP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Threat Intelligence Fundamentals and Frameworks

In threat intelligence, which term describes the raw indicators, observables, and reports collected from sources before they are evaluated and put into context?

  1. Intelligence
  2. Data Correct answer.
  3. Knowledge
  4. Information

Explanation

The data-information-intelligence progression is the standard way to describe how raw observations become decision support. Data is the unevaluated collection of facts and observables; only after processing, correlation, and contextualization does it become intelligence that can drive decisions.

Question 2Threat Intelligence Fundamentals and Frameworks

An analyst needs a structured, standardized format for exchanging indicators of compromise such as malicious IP addresses and file hashes between security tools. Which format is designed specifically for that purpose?

  1. YARA
  2. OpenIOC
  3. STIX Correct answer.
  4. Snort rules

Explanation

STIX (Structured Threat Information Expression) is a standardized language for representing cyber threat information, including indicators, threat actors, and relationships between them. It is designed for machine-to-machine sharing of threat intelligence across tools and organizations, which matches the exchange requirement described.

Question 3Threat Intelligence Fundamentals and Frameworks

Which transport mechanism is paired with STIX to define how threat intelligence is exchanged between producers and consumers over HTTP?

  1. CybOX
  2. TAXII Correct answer.
  3. MISP
  4. MITRE ATT&CK

Explanation

TAXII (Trusted Automated Exchange of Intelligence Information) is the application-layer protocol that defines how STIX content is requested, pushed, and discovered between servers. STIX describes the content while TAXII describes the transport, so TAXII is the correct pairing.

Question 4Threat Intelligence Fundamentals and Frameworks

Which intelligence level focuses on specific campaigns, their tools, and their indicators, and is used most directly by SOC analysts to tune detections?

  1. Tactical Correct answer.
  2. Strategic
  3. Operational
  4. Technical

Explanation

Tactical threat intelligence covers the immediate, technical details of adversary activity: indicators, tools, and techniques that defenders can turn into detections. SOC analysts consume tactical intelligence most directly because it maps to signatures, rules, and hunts.

Question 5Threat Intelligence Fundamentals and Frameworks

An organization wants to know which adversary groups are most likely to target its industry and how those groups' capabilities are evolving over the next year. Which intelligence level best serves this need?

  1. Tactical
  2. Signature-based
  3. Technical
  4. Strategic Correct answer.

Explanation

Strategic intelligence addresses adversary intent, capability trends, and risk to the organization over a longer horizon, which is exactly the industry-targeting and capability-evolution question posed. It is consumed by leadership to guide risk decisions rather than to write detection rules.

Question 6Threat Intelligence Fundamentals and Frameworks

Which framework organizes adversary behavior into tactics and techniques and is commonly used to map detections and prioritize defensive coverage?

  1. MITRE ATT&CK Correct answer.
  2. Cyber Kill Chain
  3. NIST CSF
  4. Diamond Model

Explanation

MITRE ATT&CK is a curated knowledge base of adversary tactics and techniques observed in real intrusions, organized by platform. Defenders use it to map detections to techniques and identify coverage gaps, which is the use described.

Question 7Threat Intelligence Fundamentals and Frameworks

In MITRE ATT&CK, what is the relationship between a tactic and a technique?

  1. A tactic is a specific tool, and a technique is the group using it
  2. A tactic is the adversary's goal, and a technique is a method used to achieve it Correct answer.
  3. A tactic is a software family, and a technique is its hash
  4. A tactic is a detection rule, and a technique is the alert it generates

Explanation

ATT&CK tactics represent the adversary's tactical goal, such as initial access or lateral movement, while techniques describe how that goal is accomplished. Techniques are grouped under tactics, so the goal-versus-method relationship is the defining structure.

Question 8Threat Intelligence Fundamentals and Frameworks

The Diamond Model of intrusion analysis models each event around four core features. Which set correctly lists them?

  1. Adversary, capability, infrastructure, victim Correct answer.
  2. Indicator, alert, incident, response
  3. Tactic, technique, procedure, tool
  4. Reconnaissance, exploitation, installation, exfiltration

Explanation

The Diamond Model represents every intrusion event as the relationship among an adversary, a capability, infrastructure, and a victim. These four vertices let analysts pivot between related events and test hypotheses about adversary activity.

Question 9Threat Intelligence Fundamentals and Frameworks

An analyst is tracking a single intrusion and wants to pivot from a known malicious server to other events that used the same infrastructure. Which analytic model is best suited to that pivoting approach?

  1. Cyber Kill Chain
  2. Diamond Model Correct answer.
  3. NIST CSF
  4. STIX

Explanation

The Diamond Model is built for analytic pivoting: because each event has adversary, capability, infrastructure, and victim vertices, an analyst can pivot on shared infrastructure to find related events. That is precisely the server-to-related-events analysis described.

Question 10Threat Intelligence Fundamentals and Frameworks

Which model divides an intrusion into sequential phases such as reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives?

  1. Diamond Model
  2. MITRE ATT&CK
  3. VERIS
  4. Cyber Kill Chain Correct answer.

Explanation

The Cyber Kill Chain, adapted from military targeting models, describes an intrusion as a sequence of phases from reconnaissance through actions on objectives. Its linear phase structure is what distinguishes it from the other models listed.

Question 11Threat Intelligence Fundamentals and Frameworks

A SOC uses the Cyber Kill Chain to argue that blocking malicious email attachments prevents an attack before the installation phase. Which kill-chain phase does the attachment delivery represent?

  1. Weaponization
  2. Delivery Correct answer.
  3. Command and control
  4. Exploitation

Explanation

Delivery is the phase in which the adversary transmits the weaponized payload to the victim, such as through a phishing email with a malicious attachment. Blocking the attachment therefore disrupts the delivery phase before exploitation or installation occurs.

Question 12Threat Intelligence Fundamentals and Frameworks

In the traffic light protocol (TLP), what does the marking TLP:RED indicate about sharing?

  1. The information may be shared only with national governments
  2. The information is limited to the named recipients and cannot be shared further Correct answer.
  3. The information may be shared with the public without restriction
  4. The information may be shared within the recipient's community

Explanation

TLP:RED is the most restrictive marking: information is intended only for the specific individuals present or named at the time of disclosure. Recipients may not redistribute it beyond that group without the source's explicit permission.

Question 13Threat Intelligence Fundamentals and Frameworks

An intelligence provider marks a report TLP:AMBER. Which action by the receiving analyst is consistent with that marking?

  1. Forward it to a peer organization's security team
  2. Share it internally within the organization on a need-to-know basis Correct answer.
  3. Publish a sanitized version on the corporate website
  4. Post the indicators publicly on a community blog

Explanation

TLP:AMBER permits sharing within the recipient's organization, typically on a need-to-know basis, but not external distribution. Internal distribution to colleagues who need the information is therefore consistent with the marking.

Question 14Threat Intelligence Fundamentals and Frameworks

Which statement best describes the difference between an indicator of compromise (IoC) and a tactic, technique, and procedure (TTP)?

  1. An IoC and a TTP are interchangeable terms for the same observable
  2. An IoC describes adversary behavior, while a TTP is a single observable artifact
  3. An IoC is an observable artifact such as a hash or domain, while a TTP describes adversary behavior and is generally more durable Correct answer.
  4. A TTP is a network signature, while an IoC is an analytic judgment

Explanation

Indicators are concrete observables, such as file hashes, IP addresses, or domains, that are easy to change and therefore short-lived. TTPs describe how adversaries operate, such as a specific credential-dumping method, and are more costly for adversaries to change, making them more durable for detection.

Question 15Threat Intelligence Fundamentals and Frameworks

An analyst has a list of file hashes from a recent campaign. Why should the analyst avoid relying solely on those hashes for long-term detection?

  1. Hashes are encrypted values that cannot be compared across systems
  2. Hashes change whenever the file is modified, so adversaries can trivially evade hash-based detection by recompiling Correct answer.
  3. Hashes only work for network traffic and never for files
  4. Hashes are behavioral descriptions that are too broad to be useful

Explanation

A cryptographic hash is tied to the exact byte content of a file, so any modification produces a different hash. Adversaries routinely recompile or repack malware to change hashes, making them low-durability indicators that should be supplemented with behavioral detections.

Question 16Threat Intelligence Fundamentals and Frameworks

Which source type is considered primary threat intelligence because it originates from the organization's own telemetry, such as its SIEM and endpoint logs?

  1. Commercial threat feeds
  2. Internal telemetry Correct answer.
  3. Industry sharing communities
  4. Open-source blogs

Explanation

Internal telemetry is first-party data generated by the organization's own sensors, such as SIEM events and endpoint detection logs, making it primary intelligence about its own environment. External feeds and communities are secondary or third-party sources that must be validated against internal data.

Question 17Threat Intelligence Fundamentals and Frameworks

According to the intelligence cycle, what is the correct order of the core phases?

  1. Planning and direction, collection, processing, analysis and production, dissemination Correct answer.
  2. Analysis, collection, planning, processing, dissemination
  3. Collection, planning, dissemination, analysis, processing
  4. Dissemination, collection, analysis, planning, processing

Explanation

The intelligence cycle begins with planning and direction, which sets requirements, then proceeds to collection, processing of raw data, analysis and production, and finally dissemination to consumers. Feedback then restarts the cycle, but the core sequence follows this order.

Question 18Threat Intelligence Fundamentals and Frameworks

A manager asks why the intelligence cycle includes a processing phase before analysis. Which rationale is correct?

  1. Processing is where dissemination to stakeholders occurs
  2. Processing is the phase where the final intelligence product is approved
  3. Processing replaces the need for collection requirements
  4. Raw collected data must be normalized, translated, and deduplicated so analysts can work with consistent, usable information Correct answer.

Explanation

Processing converts raw collected data into a form analysts can use, for example by normalizing formats, translating foreign-language material, and removing duplicates. Without this step, analysis would be slowed by inconsistent or unusable inputs.

Question 19Threat Intelligence Fundamentals and Frameworks

Which analytic technique requires an analyst to actively argue against their own hypothesis by seeking evidence that would disprove it?

  1. Pattern matching
  2. Link analysis
  3. Analysis of competing hypotheses Correct answer.
  4. Timeline reconstruction

Explanation

Analysis of competing hypotheses (ACH) is a structured method in which analysts evaluate multiple hypotheses and weigh evidence for and against each one. Its core discipline is attempting to falsify hypotheses rather than confirm a favored one, which reduces cognitive bias.

Question 20Threat Intelligence Fundamentals and Frameworks

Two threat feeds report the same malicious domain. Before treating it as confirmed, an analyst checks whether both feeds simply copied the same upstream report. Which analytic concern does this address?

  1. Confidence scoring of malware families
  2. Traffic light protocol compliance
  3. Kill chain phase identification
  4. Source independence and corroboration Correct answer.

Explanation

Corroboration only strengthens an assessment when the sources are independent; if both feeds derive from a single upstream report, they are effectively one source. Checking for common origin prevents analysts from overstating confidence based on duplicated reporting.

Question 21Threat Intelligence Fundamentals and Frameworks

In the Admiralty source reliability and information credibility system, what does a source rated 'A' with information rated '1' represent?

  1. A usually reliable source providing improbable information
  2. A source of unknown reliability providing unconfirmed information
  3. A completely reliable source providing information confirmed by other sources Correct answer.
  4. An unreliable source providing possibly true information

Explanation

The Admiralty scale pairs a letter for source reliability with a number for information credibility. 'A' means completely reliable and '1' means confirmed by other sources, so A1 is the highest combined rating.

Question 22Threat Intelligence Fundamentals and Frameworks

Which of the following best describes the purpose of a threat intelligence platform (TIP)?

  1. To provide a firewall rule set for blocking all inbound traffic
  2. To replace the SIEM by storing all raw log data indefinitely
  3. To serve as an endpoint detection and response agent on hosts
  4. To aggregate, normalize, deduplicate, and distribute threat intelligence and integrate it with security controls Correct answer.

Explanation

A TIP ingests intelligence from multiple feeds, normalizes formats, removes duplicates, scores and enriches indicators, and distributes the results to tools such as SIEMs and firewalls. Its role is intelligence management and integration rather than raw log storage or endpoint enforcement.

Question 23Threat Intelligence Fundamentals and Frameworks

An analyst wants to add an indicator to a TIP so it expires automatically after 30 days because the associated campaign is expected to be short-lived. Which indicator property is being set?

  1. Kill chain phase
  2. Confidence score
  3. Validity period Correct answer.
  4. TLP marking

Explanation

A validity period defines how long an indicator should be considered actionable before it is retired or reviewed. Setting a 30-day expiry reflects the expected lifetime of the campaign and prevents stale indicators from lingering in detection systems.

Question 24Threat Intelligence Fundamentals and Frameworks

Why is indicator aging important in a threat intelligence program?

  1. Aging indicators increases their confidence score automatically
  2. Indicators become more accurate over time and should never expire
  3. Indicators can become stale or be reassigned to legitimate users, causing false positives if kept indefinitely Correct answer.
  4. Aging is required by STIX to validate the schema

Explanation

Many indicators, such as IP addresses and domains, are transient and may later be reassigned to benign parties. Retiring or reviewing older indicators reduces false positives and keeps detection content aligned with current adversary activity.

Question 25Threat Intelligence Fundamentals and Frameworks

An organization receives a report describing an adversary's long-term strategic goals and preferred sectors, with no technical indicators. Which consumer is the intended audience?

  1. Executive leadership and risk owners Correct answer.
  2. Firewall administrators adding block lists
  3. SOC tier-one analysts writing detection rules
  4. Malware reverse engineers extracting hashes

Explanation

Reports focused on adversary intent, targeting, and long-term goals are strategic intelligence intended for decision-makers who allocate risk and resources. They contain no actionable technical detail, so operational roles have little to act on.

Question 26Threat Intelligence Fundamentals and Frameworks

In threat intelligence, which statement best distinguishes operational intelligence (OPINT) from tactical intelligence?

  1. Operational intelligence focuses on specific ongoing campaigns and adversary intent, while tactical intelligence focuses on immediate indicators and TTPs for day-to-day defense. Correct answer.
  2. Operational intelligence is derived exclusively from open-source news, while tactical intelligence comes only from classified government feeds.
  3. Operational intelligence is always shared at TLP:RED, while tactical intelligence is always shared at TLP:WHITE.
  4. Operational intelligence consists only of technical indicators such as IP addresses and file hashes, while tactical intelligence covers adversary doctrine and long-term goals.

Explanation

Operational intelligence addresses the who, why, and how of specific adversary operations and campaigns, helping defenders understand intent and targeting. Tactical intelligence provides actionable, often technical details like indicators and TTPs used for immediate detection and response. The two levels serve different planning horizons and consumers, not different sharing restrictions or source types by definition.

Question 27Threat Intelligence Fundamentals and Frameworks

An analyst receives a finished intelligence report that includes a confidence assessment of 'high' for an attribution claim. According to structured analytic standards, what does this confidence level primarily communicate?

  1. The number of independent sources that were used, regardless of their reliability or access.
  2. The analytic tradecraft used to reach the judgment and the likelihood that the judgment is correct, given the available evidence. Correct answer.
  3. The classification level of the sources, where high confidence means only top-secret sources were used.
  4. The probability that the adversary will change tactics within the next 24 hours.

Explanation

Confidence assessments describe how much the analyst trusts the judgment based on the quality of sources, analytic tradecraft, and consistency of evidence. They are not a simple source count or a classification label. High confidence indicates a strong likelihood the judgment is correct, not a prediction of imminent adversary behavior.

Question 28Threat Intelligence Fundamentals and Frameworks

An analyst is using the MITRE ATT&CK framework to map adversary behavior. They observe a technique that is used across multiple tactics. How should the analyst interpret this technique's placement in ATT&CK?

  1. The technique's tactic assignment is irrelevant because ATT&CK only tracks techniques, not tactics.
  2. The technique must be assigned to exactly one tactic, and ATT&CK assigns it to the tactic where it was first observed.
  3. The technique is deprecated and should not be used for detection mapping.
  4. The technique can appear under several tactics because the same action can serve different adversary goals depending on context. Correct answer.

Explanation

MITRE ATT&CK allows techniques to be associated with multiple tactics when the same behavior can support different adversary objectives. For example, a command can be used for execution or for discovery depending on the operation's context. Analysts should consider the surrounding behavior to determine which tactic best fits the observed event.

Question 29Threat Intelligence Fundamentals and Frameworks

A threat intelligence analyst is evaluating a report about a new malware family. The report cites only a single vendor blog post with no independent corroboration. How should the analyst treat the report's technical details?

  1. Discard the report entirely because single-source reporting is never useful.
  2. Accept the details as fully confirmed because the vendor is a known security company.
  3. Treat the details as unconfirmed and seek independent corroboration before using them for detection or blocking. Correct answer.
  4. Immediately add all indicators to production blocklists to avoid missing the threat.

Explanation

Single-source reporting should be treated cautiously until corroborated by independent sources or telemetry. Vendor blogs can be valuable but may contain errors or be based on limited visibility. Confirming details before operational use reduces false positives and avoids overreliance on one perspective.

Question 30Threat Intelligence Fundamentals and Frameworks

An analyst is building a threat model for a new web application and wants to align with a framework that organizes adversary tactics and techniques. Which approach best uses MITRE ATT&CK for this purpose?

  1. Apply every technique in ATT&CK equally, because all techniques are equally likely for any application.
  2. Use ATT&CK only to classify malware samples, not to inform defensive design.
  3. Map likely adversary techniques to the application's attack surface and prioritize detections for the tactics that are most relevant to the application's exposure. Correct answer.
  4. Use ATT&CK to replace the organization's risk assessment process entirely, since ATT&CK covers all possible threats.

Explanation

ATT&CK is most effective when analysts map relevant techniques to the specific environment and prioritize based on exposure and threat relevance. It is a knowledge base, not a complete risk assessment replacement. Applying all techniques equally ignores context and wastes resources.

Question 31Threat Landscape and Actor Analysis

Which threat actor category is defined primarily by operating on behalf of a nation-state to advance its strategic interests?

  1. State-sponsored actor Correct answer.
  2. Insider threat
  3. Hacktivist collective
  4. Cybercriminal syndicate

Explanation

State-sponsored actors receive direction, funding, or protection from a government and pursue espionage, disruption, or influence objectives aligned with national strategy rather than personal profit. Attribution to this category rests on evidence of state tasking, infrastructure, and target selection.

Question 32Threat Landscape and Actor Analysis

A group deploys ransomware against hospitals, then publishes stolen patient records when payment is refused. Which motivation profile best fits this behavior?

  1. Hacktivism targeting public visibility
  2. Financially motivated extortion with data-leak pressure Correct answer.
  3. Nation-state espionage seeking long-term persistence
  4. Insider revenge without financial gain

Explanation

Double extortion combines encryption with the threat of releasing exfiltrated data, which monetizes both availability and confidentiality. The choice of a healthcare victim and the leak threat indicate revenue-driven pressure rather than intelligence collection.

Question 33Threat Landscape and Actor Analysis

What distinguishes an advanced persistent threat from opportunistic commodity malware?

  1. Reliance on publicly available ransomware builders
  2. Sustained, stealthy access tailored to a specific target over time Correct answer.
  3. Exclusive focus on consumer devices
  4. Use of only zero-day exploits in every intrusion

Explanation

An APT is characterized by prolonged, low-observability presence, custom tooling, and mission focus on selected victims. Exploit novelty is not the defining trait, because many APTs use valid credentials and living-off-the-land techniques.

Question 34Threat Landscape and Actor Analysis

Which source type is considered unstructured threat intelligence that still requires enrichment before operational use?

  1. Vendor advisories mapped to ATT&CK
  2. Internal incident postmortems
  3. Curated analyst reports with context
  4. Raw indicator feeds of IP addresses Correct answer.

Explanation

Raw indicator feeds are low-context data points that gain value only after enrichment with ownership, history, and campaign linkage. Structured and curated products already carry the context needed for decision-making.

Question 35Threat Landscape and Actor Analysis

An analyst finds a malware sample whose command-and-control domain was registered three days before the attack. What does this most strongly suggest?

  1. Legitimate third-party hosting abuse only
  2. Reuse of long-standing botnet infrastructure
  3. Infrastructure purpose-built for this campaign Correct answer.
  4. A false positive from sinkholed traffic

Explanation

Very recent domain registration relative to the intrusion indicates infrastructure staged specifically for the operation. Actors often pre-position domains shortly before use to limit blocklist coverage and reduce exposure.

Question 36Threat Landscape and Actor Analysis

Which best describes the role of initial access brokers in the cybercriminal ecosystem?

  1. They develop nation-state espionage implants
  2. They operate certificate authorities for phishing sites
  3. They provide legal incident response to victim organizations
  4. They sell footholds such as VPN credentials to ransomware operators Correct answer.

Explanation

Initial access brokers specialize in gaining and reselling access, letting ransomware affiliates focus on post-exploitation. This specialization is a hallmark of the commoditized criminal supply chain.

Question 37Threat Landscape and Actor Analysis

Which indicator is most likely to be short-lived and should be prioritized for rapid automated action rather than long-term blocklisting?

  1. A command-and-control IP address rotated hourly Correct answer.
  2. A threat actor's preferred spearphishing theme
  3. A malware family's code-signing certificate subject
  4. A toolmark in a compiled binary

Explanation

Rapidly rotated infrastructure has a short useful lifetime, so it suits automated blocking and detection while it remains active. Behavioral and toolmark indicators persist longer and inform hunting rather than transient blocking.

Question 38Threat Landscape and Actor Analysis

Which term describes the process of associating an intrusion with a specific actor or group?

  1. Deconfliction
  2. Enrichment
  3. Attribution Correct answer.
  4. Normalization

Explanation

Attribution links observed activity to a responsible actor using technical, operational, and contextual evidence. It is distinct from data-handling steps such as enrichment or normalization.

Question 39Threat Landscape and Actor Analysis

A retailer sees fraudulent card transactions weeks after a breach that left no malware on point-of-sale terminals. Which threat pattern should investigators prioritize?

  1. Credential stuffing against customer accounts
  2. Web skimming of payment pages on the e-commerce site Correct answer.
  3. Ransomware encryption of backend databases
  4. DDoS extortion against the storefront

Explanation

Magecart-style skimming injects malicious script into checkout pages to capture card data in the browser, leaving endpoints clean. The delayed fraud pattern fits card capture at the web layer rather than host compromise.

Question 40Threat Landscape and Actor Analysis

An intrusion uses stolen but valid credentials, remote management tools already present in the environment, and no custom malware. Which detection strategy is most appropriate?

  1. Blocklisting the actor's known C2 domains only
  2. Behavioral analytics on anomalous use of legitimate tools Correct answer.
  3. Monitoring only perimeter firewall denies
  4. Signature scanning for known malware hashes

Explanation

Living-off-the-land tradecraft evades signature and indicator controls because the components are legitimate. Detection therefore depends on baselining normal administrative behavior and flagging deviations such as unusual remote tool usage.

Question 41Threat Landscape and Actor Analysis

Which analytic pitfall occurs when an investigator assumes that shared infrastructure proves a single actor is responsible?

  1. Premature indicator aging
  2. Over-reliance on behavioral detection
  3. Scope creep in incident response
  4. False attribution through infrastructure overlap Correct answer.

Explanation

Shared hosting, bulletproof services, and compromised servers can be used by multiple groups, so overlap alone is weak evidence. Attribution requires corroboration across tooling, targeting, and timing.

Question 42Threat Landscape and Actor Analysis

A threat report lists a malware family used by several unrelated groups. What does this most likely indicate?

  1. A single actor conducting false-flag operations
  2. Definitive proof of state sponsorship
  3. An error in the report's sourcing
  4. Commodity or leaked tooling shared across the ecosystem Correct answer.

Explanation

Tool sharing is common when malware is sold, leaked, or repurposed, so a family name is a weak attribution anchor. Analysts should weigh tooling alongside infrastructure, targeting, and operational patterns.

Question 43Threat Landscape and Actor Analysis

Which collection discipline would best reveal an actor's long-term strategic intent rather than immediate technical indicators?

  1. Finished intelligence assessments from trusted analysts Correct answer.
  2. Sandbox execution reports
  3. Firewall log exports
  4. Raw passive DNS records

Explanation

Finished intelligence synthesizes multiple sources into judgments about intent, capability, and likely future activity. Raw technical feeds support tactical detection but rarely explain strategic objectives on their own.

Question 44Threat Landscape and Actor Analysis

During hunting, an analyst observes scheduled tasks created by a service account outside its normal maintenance window. Which hypothesis is most relevant?

  1. Persistence established via legitimate scheduling mechanisms Correct answer.
  2. Ransomware encryption in progress
  3. Data exfiltration over DNS tunneling
  4. Supply chain compromise of a software update

Explanation

Abuse of native schedulers is a common persistence technique that blends with administrative activity. The anomaly is timing and account context, which points to misuse of legitimate scheduling rather than other attack stages.

Question 45Threat Landscape and Actor Analysis

Which factor most increases the difficulty of attributing a destructive wiper attack?

  1. Use of encrypted C2 channels
  2. Presence of ransomware notes
  3. Deliberate use of false flags and shared tooling Correct answer.
  4. Absence of any log retention

Explanation

Actors may plant artifacts from other groups or reuse public tools to mislead investigators, raising the evidentiary bar. Attribution then relies on converging independent evidence rather than a single artifact.

Question 46Threat Landscape and Actor Analysis

An organization wants to prioritize patching based on observed exploitation by sophisticated actors. Which input is most directly relevant?

  1. Vendor marketing materials
  2. Internal asset counts without threat context
  3. Intelligence on vulnerabilities actively exploited by tracked actors Correct answer.
  4. General vulnerability severity scores alone

Explanation

Threat-informed prioritization weighs whether tracked actors are exploiting a vulnerability, which complements severity scoring. CVSS alone reflects potential impact, not real-world targeting.

Question 47Threat Landscape and Actor Analysis

Which behavior most strongly indicates an actor is conducting espionage rather than financial crime?

  1. Mass defacement of public websites
  2. Long-dwell collection of documents from diplomatic networks Correct answer.
  3. Rapid encryption of servers for ransom
  4. Sale of access on a criminal forum

Explanation

Espionage prioritizes quiet, sustained collection of information aligned with strategic interests. Financial crime emphasizes monetization through encryption, fraud, or access sales.

Question 48Threat Landscape and Actor Analysis

What is the primary purpose of the MITRE ATT&CK framework in threat landscape analysis?

  1. Describing adversary behaviors in a common taxonomy Correct answer.
  2. Managing patch deployment schedules
  3. Providing legal guidance on breach notification
  4. Scoring vulnerability severity

Explanation

ATT&CK organizes observed adversary tactics and techniques so defenders can compare groups and map detections. It is not a severity scoring system or a compliance tool.

Question 49Threat Landscape and Actor Analysis

An analyst receives a tip that a new group is targeting the same sector as a known APT but uses entirely different tooling. What is the most defensible analytic judgment?

  1. Merge the group into the known APT immediately
  2. Assess as a distinct cluster pending corroborating evidence Correct answer.
  3. Dismiss the tip because tooling differs
  4. Conclude it is a false flag by the known APT

Explanation

Different tooling with similar targeting may indicate a separate cluster, a rebrand, or a subcontractor relationship, so the judgment should remain provisional. Analysts avoid premature merging or dismissal until independent evidence converges.

Question 50Threat Landscape and Actor Analysis

Which indicator pairing best supports high-confidence detection of a specific campaign?

  1. Generic PowerShell execution
  2. A distinctive toolmark combined with a unique C2 URI pattern Correct answer.
  3. A common user-agent string alone
  4. A popular cloud provider's IP range

Explanation

Combining a relatively unique code artifact with a distinctive network pattern raises specificity and lowers false positives. Individually common artifacts such as PowerShell or shared cloud ranges are too noisy for campaign-level detection.