I85PREP
⌘ K
CNCDP study materials
CNCDP study resources

CNCDP practice questions

One question at a time. Build your CNCDP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security Architecture and Design

A security architect places the internet-facing web tier in a subnet that can accept inbound connections from the internet but can only initiate outbound connections to the application tier. Which design pattern does this describe?

  1. A full-mesh peer-to-peer segment shared by all tiers
  2. A flat internal network with host-based firewalls only
  3. An air-gapped enclave with no external connectivity
  4. A screened subnet with tier-restricted egress filtering Correct answer.

Explanation

A screened subnet (DMZ) exposes only the public-facing tier while filtering its outbound traffic to just the next tier, limiting lateral movement if the web tier is compromised. The other choices either remove segmentation entirely or eliminate the required inbound connectivity.

Question 2Network Security Architecture and Design

Which security control best reduces the risk of an attacker moving laterally between workloads on the same physical host in a virtualized data center?

  1. Disabling logging on inter-VM traffic to save storage
  2. Relying on physical switch ACLs only at the rack boundary
  3. Microsegmentation enforced at the hypervisor virtual switch Correct answer.
  4. A larger broadcast domain for all virtual machines

Explanation

Hypervisor-level microsegmentation applies per-workload policy that follows the VM even when it migrates, so traffic between VMs on the same host is inspected and filtered. Rack-boundary ACLs and shared broadcast domains do not control intra-host traffic.

Question 3Network Security Architecture and Design

An organization needs to protect data at rest on a database server while ensuring that a stolen disk image cannot be read offline. Which control directly addresses this requirement?

  1. Full-disk or volume encryption with keys stored in a hardware security module Correct answer.
  2. TLS termination at the load balancer
  3. File integrity monitoring on the database binaries
  4. Network address translation on the perimeter firewall

Explanation

Encryption of the volume with keys held outside the disk ensures that a copied disk image is unreadable without access to the key management system. Transport encryption, NAT, and integrity monitoring do not protect data at rest against offline disk theft.

Question 4Network Security Architecture and Design

Which protocol and port combination is the standard secure alternative to Telnet for remote administration of network devices?

  1. SNMP over UDP 161
  2. SSH over TCP 22 Correct answer.
  3. TFTP over UDP 69
  4. HTTP over TCP 80

Explanation

SSH provides an encrypted channel for remote command-line administration and replaces Telnet, which transmits credentials in cleartext. The other protocols either lack encryption or are used for different management functions.

Question 5Network Security Architecture and Design

In a zero trust architecture, what is the primary basis for granting access to a resource?

  1. The user having previously authenticated once at the start of the day
  2. The source IP address being inside the corporate network range
  3. The device being connected to a specific VLAN
  4. Continuous evaluation of identity, device posture, and context per request Correct answer.

Explanation

Zero trust makes each access decision from identity, device health, and contextual signals rather than from network location. Implicit trust based on being inside the perimeter or on a single prior login is exactly what the model removes.

Question 6Network Security Architecture and Design

Which component of an identity-aware proxy architecture terminates the user session and enforces policy before forwarding traffic to an internal application?

  1. The internal application server itself
  2. The endpoint's local hosts file
  3. The policy enforcement point that brokers the connection Correct answer.
  4. The DNS resolver for the internal zone

Explanation

In an identity-aware proxy the policy enforcement point terminates the client session, validates identity and context, and only then proxies the request to the protected application. The application and DNS components do not perform session-level authorization.

Question 7Network Security Architecture and Design

Which design element provides defense in depth for the DNS layer against domain-generation-algorithm malware callbacks?

  1. Allowing all outbound UDP 53 to any resolver
  2. Response policy zones and sinkholing on recursive resolvers Correct answer.
  3. Disabling DNSSEC validation to speed lookups
  4. Increasing the DNS cache TTL to one week

Explanation

Response policy zones let recursive resolvers block or sinkhole known-malicious domains, which disrupts DGA callback resolution. Longer TTLs, open outbound DNS, and disabling validation all weaken rather than strengthen DNS-layer defense.

Question 8Network Security Architecture and Design

A network architect is choosing between stateful and stateless packet filtering for a perimeter gateway. Which statement correctly describes a key difference?

  1. Stateless filtering requires a proxy for every protocol
  2. Stateful inspection tracks connection state so return traffic can be allowed without broad inbound rules Correct answer.
  3. Stateful inspection cannot evaluate TCP flags
  4. Stateless filtering tracks TCP sessions in a connection table

Explanation

Stateful firewalls maintain a session table, so replies to outbound flows are permitted automatically and inbound rules can stay narrow. Stateless filters evaluate each packet in isolation and require explicit rules for return traffic.

Question 9Network Security Architecture and Design

An enterprise wants to give remote workers access to internal applications without exposing those applications directly to the internet. Which architecture best meets this goal?

  1. Publishing each application on a public IP with host firewalls
  2. Extending the internal Layer 2 domain to remote sites over a flat tunnel
  3. A remote-access broker that authenticates users and proxies sessions to internal apps Correct answer.
  4. Using split tunneling so only public sites traverse the tunnel

Explanation

An access broker terminates authenticated sessions at the edge and proxies them to internal applications, so the apps never listen on public addresses. Direct publishing and flat Layer 2 extension both increase exposure and blast radius.

Question 10Network Security Architecture and Design

A company is designing a hybrid cloud connection and requires that traffic between on-premises and cloud workloads never traverse the public internet. Which approach satisfies this requirement?

  1. A CDN edge cache shared by both environments
  2. A dedicated private interconnect or site-to-site VPN with encrypted tunnels Correct answer.
  3. An internet-facing load balancer in each region
  4. A public internet gateway with NAT

Explanation

A dedicated interconnect or encrypted site-to-site VPN carries traffic over private or tunneled paths rather than the open internet. Public gateways, internet-facing load balancers, and CDN caches all rely on internet routing.

Question 11Network Security Architecture and Design

During a design review, an architect proposes placing a web application firewall in detect-only mode in production indefinitely. What is the most significant consequence of that decision?

  1. The application loses its ability to scale horizontally
  2. Session cookies are automatically encrypted
  3. Malicious requests are logged but still delivered to the application Correct answer.
  4. TLS handshakes fail for all clients

Explanation

Detect-only mode generates alerts without blocking, so exploit attempts reach the application and rely on downstream controls to stop them. It has no effect on TLS, scaling, or cookie encryption.

Question 12Network Security Architecture and Design

An organization segments its data center so that the payment card environment is isolated from general corporate systems. Which compliance-driven rationale most directly justifies this segmentation?

  1. Allowing card data to be replicated to every department share
  2. Eliminating the need for any encryption of stored card data
  3. Reducing the scope of systems subject to cardholder data requirements Correct answer.
  4. Removing the requirement for logging in the card environment

Explanation

Isolating the cardholder data environment limits which systems are in scope for payment card controls, reducing audit and compliance burden. Segmentation does not remove encryption or logging obligations, and broad replication increases risk.

Question 13Network Security Architecture and Design

A security team wants to detect command-and-control beaconing that uses encrypted HTTPS to rare external destinations. Which architectural placement of monitoring is most effective?

  1. Egress inspection at a TLS-brokering forward proxy with metadata logging Correct answer.
  2. Host antivirus logs aggregated weekly
  3. Span ports on internal access switches only
  4. NetFlow export from core routers without payload metadata

Explanation

Beaconing to rare destinations is best detected where outbound sessions can be observed with destination reputation and metadata, such as a TLS-brokering egress proxy. Internal span ports and flow records alone miss the destination context and cadence detail.

Question 14Network Security Architecture and Design

An architect must design key management for a multi-tenant SaaS platform so that one tenant's compromise cannot expose another tenant's data keys. Which design principle applies?

  1. A single shared master key for all tenants
  2. Storing all data keys alongside the ciphertext in plaintext
  3. Deriving keys from a hard-coded application secret
  4. Per-tenant key hierarchy with envelope encryption and isolated key stores Correct answer.

Explanation

A per-tenant key hierarchy with envelope encryption confines a compromise to one tenant's key domain, and isolating key stores prevents cross-tenant access. Shared master keys, plaintext key storage, and hard-coded secrets all create single points of failure.

Question 15Network Security Architecture and Design

A network design uses 802.1X with dynamic VLAN assignment for wired ports. Which outcome best demonstrates that the design is functioning as intended?

  1. The switch disables 802.1X after the first successful login
  2. All devices share a single guest VLAN regardless of identity
  3. An unauthenticated device receives the production VLAN
  4. An unauthenticated device is placed in a restricted remediation VLAN Correct answer.

Explanation

Dynamic VLAN assignment places endpoints into VLANs based on authentication result, so unknown devices land in a restricted or remediation segment rather than production. Disabling 802.1X or collapsing all devices into one VLAN defeats the control.

Question 16Network Security Architecture and Design

An organization is deploying a DMZ that must host both a public web front end and a backend API. Which placement of the API best limits exposure if the web front end is compromised?

  1. In a separate internal segment reachable only from the web tier through a controlled proxy Correct answer.
  2. In the corporate user VLAN alongside employee workstations
  3. Directly on the internet with API-key authentication only
  4. On the same host as the web front end for lowest latency

Explanation

Placing the API in a distinct segment that only the web tier can reach through a controlled path limits lateral movement from a compromised front end. Co-locating, direct internet exposure, and user-VLAN placement all widen the attack surface.

Question 17Network Security Architecture and Design

A design team is selecting a VPN technology for site-to-site links. Which characteristic most strongly favors IPsec in tunnel mode over a plain GRE tunnel?

  1. Confidentiality and integrity of the encapsulated payload Correct answer.
  2. Native support for multicast routing without configuration
  3. Lower CPU overhead on the routers
  4. Simpler troubleshooting with cleartext captures

Explanation

IPsec in tunnel mode encrypts and authenticates the entire inner packet, providing confidentiality and integrity that GRE alone lacks. GRE is lighter and multicast-friendly but carries payload in cleartext.

Question 18Network Security Architecture and Design

An architect proposes a hub-and-spoke topology for branch connectivity with all inter-branch traffic forced through a central security stack. Which tradeoff should be highlighted in the design review?

  1. It removes the need for any routing at branch sites
  2. It eliminates the central security stack from the data path
  3. Centralized inspection improves control but adds latency and creates a bandwidth bottleneck Correct answer.
  4. It guarantees equal latency for all branch pairs

Explanation

Hairpinning inter-branch flows through a central stack gives consistent inspection but adds round-trip latency and concentrates bandwidth demand at the hub. It does not remove branch routing or take the security stack out of the path.

Question 19Network Security Architecture and Design

A company wants to enforce that only compliant managed devices can reach internal SaaS applications, even when users authenticate successfully from unmanaged devices. Which control combination achieves this?

  1. Device posture attestation combined with conditional access policy Correct answer.
  2. Password complexity rules alone
  3. A captive portal that accepts any device
  4. Static IP allowlisting for all office ranges

Explanation

Conditional access evaluates device posture from attestation signals and denies or limits access when the device is unmanaged or noncompliant. Passwords, open portals, and IP allowlists do not verify device health.

Question 20Network Security Architecture and Design

An architect is designing a network tap and span strategy for intrusion detection. Which consideration most affects whether the IDS can reconstruct full sessions?

  1. The color of the fiber patch cables
  2. The number of VLANs configured on the core
  3. The DNS zone transfer policy
  4. Whether both directions of each flow are delivered to the same sensor Correct answer.

Explanation

Session reconstruction requires the sensor to see both directions of a flow; asymmetric span or tap configurations cause the IDS to miss half the conversation. Cable color, VLAN count, and zone transfer policy do not determine bidirectional visibility.

Question 21Network Security Architecture and Design

A regulated environment requires that administrative access to network devices be brokered, recorded, and time-limited. Which architecture satisfies all three requirements?

  1. Shared local administrator accounts rotated annually
  2. A jump host with permanent credentials stored in a shared wiki
  3. A privileged access management gateway that issues short-lived credentials and records sessions Correct answer.
  4. Direct SSH from analyst laptops to device management IPs

Explanation

A privileged access management gateway brokers connections, vaults credentials, issues short-lived grants, and records sessions, meeting brokering, recording, and time-limiting together. Shared accounts, direct access, and wiki-stored credentials fail one or more requirements.

Question 22Network Security Architecture and Design

A security architect must design for confidentiality of traffic between two data centers while also allowing lawful interception by an authorized internal team. Which design element reconciles these goals?

  1. Encryption terminated at unmanaged third-party endpoints
  2. Encrypted tunnels terminated at controlled inspection points with role-based access to decrypted captures Correct answer.
  3. Cleartext links with no access controls on capture devices
  4. End-to-end encryption with keys held only by end hosts and no inspection capability

Explanation

Terminating tunnels at controlled inspection points preserves confidentiality on the wire while enabling authorized, logged access to decrypted traffic under role-based controls. Host-only keys or cleartext links fail one of the two goals.

Question 23Network Security Architecture and Design

An organization is designing a multi-region architecture and wants to ensure that a regional outage does not break authentication for the remaining regions. Which design choice best addresses this?

  1. Pinning all authentication to a single primary region
  2. Replicating identity data across regions with local authentication endpoints and defined failover Correct answer.
  3. Caching credentials only in the affected region
  4. Relying on a single on-premises directory with no replication

Explanation

Replicated identity data with regional authentication endpoints lets surviving regions serve logins during an outage. Single-region pinning, region-local caches, and unreplicated directories all create an authentication single point of failure.

Question 24Network Security Architecture and Design

A design review finds that a microservice mesh uses mutual TLS for service identity but permits any authenticated service to call any other service. Which change most improves least-privilege enforcement?

  1. Increasing the mTLS certificate key length
  2. Enabling verbose access logs on the mesh sidecars
  3. Rotating certificates more frequently
  4. Adding authorization policy that restricts each service to its declared upstream dependencies Correct answer.

Explanation

Mutual TLS establishes identity but not authorization; least privilege requires policy that limits each service to its declared callers and callees. Stronger keys, faster rotation, and logging improve hygiene without restricting which services may communicate.

Question 25Network Security Architecture and Design

An architect must protect an industrial control network from enterprise IT while still allowing telemetry to flow to a historian. Which design most appropriately enforces the boundary?

  1. A shared domain trust with bidirectional replication
  2. A direct Layer 2 bridge between IT and the control network
  3. An industrial DMZ with unidirectional or tightly brokered data flows between zones Correct answer.
  4. A single flat VLAN spanning both environments

Explanation

An industrial DMZ with unidirectional gateways or brokered flows lets telemetry reach the historian while preventing enterprise-to-control reachability. Bridging, shared trust, and flat VLANs create direct paths that bypass the boundary.

Question 26Network Security Architecture and Design

In a Zero Trust architecture, the Policy Decision Point (PDP) and the Policy Enforcement Point (PEP) are logically separated. Which statement best describes the division of responsibility between these two components?

  1. The PDP evaluates context such as identity, device posture, and request attributes to render an access decision, while the PEP enforces that decision on the actual traffic path. Correct answer.
  2. The PEP evaluates identity and device posture and returns a token, while the PDP stores audit logs and reconciles policy conflicts between tenants.
  3. The PDP sits inline on the data path and forwards packets, while the PEP defines the policy rules that the PDP later compiles into signatures.
  4. The PEP and PDP must be co-located in the same appliance because enforcement decisions cannot cross a network boundary.

Explanation

Zero Trust separates the function that decides access from the function that enforces it. The PDP consumes signals such as user identity, device health, and request context and returns a decision, and the PEP applies that decision at the point where traffic actually flows. Keeping the roles distinct lets a single decision engine govern many enforcement points.

Question 27Network Security Architecture and Design

A security architect is designing segmentation for a data center and wants inter-segment traffic to be inspected by a firewall without routing every flow through a single central appliance. Which approach best matches this requirement?

  1. A distributed firewall model in which policy is enforced at the hypervisor or host level close to each workload Correct answer.
  2. Spanning every segment to a centralized intrusion detection sensor and blocking on its alerts
  3. A single large perimeter firewall with all segments connected as separate interfaces on that device
  4. A flat Layer 2 domain with VLANs and access control lists applied only at the core switch

Explanation

Distributed enforcement places the policy close to the workload, so east-west traffic is filtered without hairpinning through a central chokepoint. This preserves segmentation while avoiding the latency and scaling limits of a single appliance. It also lets policy follow the workload as it moves between hosts.

Question 28Network Security Architecture and Design

A company is designing remote access for third-party contractors who need to reach a small set of internal web applications. The architect wants per-application authorization, no broad network-level access, and the ability to terminate sessions at a broker. Which design best satisfies these goals?

  1. A clientless application proxy that authenticates users and authorizes each application before proxying the session Correct answer.
  2. A jump host in the DMZ that contractors reach over RDP and from which they browse internal sites
  3. A site-to-site VPN between the contractor's office network and the corporate core
  4. A full-tunnel IPsec VPN that places contractors on a dedicated subnet with routes to the application VLANs

Explanation

An application proxy authenticates the user, evaluates per-application policy, and brokers each session, so contractors never receive network-level reachability. This limits exposure to the specific applications that were authorized. The broker also provides a natural point for session termination and logging.

Question 29Network Security Architecture and Design

An architect is designing logging for a segmented network and must ensure that if an attacker compromises one segment, they cannot alter or delete the evidence of their activity. Which design choice most directly supports that goal?

  1. Storing logs locally on each segment's switches with large local disks
  2. Enabling verbose debugging on all devices and reviewing the buffers only after an incident
  3. Sending logs over the production data plane to a collector inside the same segment
  4. Forwarding logs to a hardened, separately segmented collector with write-once storage and restricted administrative access Correct answer.

Explanation

Log integrity depends on getting records out of the compromised trust zone quickly and onto a system the attacker cannot reach or rewrite. A separate log segment with append-only or write-once storage and tightly limited admin access supports that. It also keeps the collector from being reachable through the same paths an intruder already controls.

Question 30Network Security Architecture and Design

A retail company is designing a guest Wi-Fi architecture. Guests must reach the internet, must not reach internal corporate systems, and must be prevented from attacking each other on the same wireless LAN. Which combination of controls best achieves all three requirements?

  1. The corporate SSID with 802.1X for guests and a captive portal for registration
  2. A separate guest SSID on the corporate VLAN with a firewall rule blocking RFC 1918 destinations
  3. A guest SSID bridged directly to the internet-facing router with no VLAN separation
  4. A separate guest SSID mapped to an isolated VLAN with a stateful firewall to the internet, plus client isolation on the wireless infrastructure Correct answer.

Explanation

Segmentation requires both logical separation and an enforcement point. A dedicated guest VLAN isolated by a stateful firewall blocks reachability to corporate systems, and client isolation stops guest-to-guest attacks at Layer 2. Together they satisfy all three stated requirements.

Question 31Threat Landscape and Threat Intelligence

In the Cyber Kill Chain model, which phase immediately follows 'Weaponization'?

  1. Reconnaissance
  2. Exploitation
  3. Command and Control
  4. Delivery Correct answer.

Explanation

The Lockheed Martin Cyber Kill Chain proceeds Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Weaponization couples an exploit with a deliverable payload, and the next phase is Delivery, where the weaponized artifact is transmitted to the target.

Question 32Threat Landscape and Threat Intelligence

An analyst wants a structured, machine-readable standard for expressing and automatically sharing indicators of compromise between organizations. Which specification is designed primarily for that purpose?

  1. Snort rules
  2. STIX Correct answer.
  3. YARA
  4. MITRE ATT&CK

Explanation

STIX (Structured Threat Information Expression) is a language for representing cyber threat intelligence as structured objects and relationships, and it is commonly paired with TAXII for transport. It is purpose-built for expressing and exchanging indicators and related context between parties.

Question 33Threat Landscape and Threat Intelligence

Which term describes an indicator that has been observed in a real environment but is not inherently malicious, such as a legitimate administrative tool that adversaries also abuse?

  1. Indicates Correct answer.
  2. False positive
  3. Benign indicator
  4. Atomic indicator

Explanation

In threat-intelligence terminology, 'indicates' are observables that have been judged to have some intelligence value and context, distinguishing them from raw observables. The term reflects that the artifact carries meaning about adversary behavior rather than being malicious by itself.

Question 34Threat Landscape and Threat Intelligence

A threat-intel team receives a feed of IP addresses with no context. Which characteristic most limits the operational value of this feed?

  1. It lacks context such as associated adversary, campaign, and time window Correct answer.
  2. It contains too many indicators for a SIEM to ingest
  3. It is delivered in plain text rather than JSON
  4. It uses IPv4 rather than IPv6 addressing

Explanation

Indicators without context cannot be prioritized, scoped, or confidently attributed, and they age quickly as infrastructure is repurposed. Context such as the associated actor, campaign, and first-seen/last-seen timestamps is what makes an indicator actionable for detection and response.

Question 35Threat Landscape and Threat Intelligence

Which intelligence discipline relies primarily on human sources such as insiders, informants, or adversary defectors?

  1. SIGINT
  2. IMINT
  3. OSINT
  4. HUMINT Correct answer.

Explanation

HUMINT, or human intelligence, is collected through human sources and interpersonal contact rather than technical sensors. SIGINT, OSINT, and IMINT draw on signals, public sources, and imagery respectively, so they do not depend on human informants as the primary collection method.

Question 36Threat Landscape and Threat Intelligence

A SOC wants to detect adversary use of the technique of dumping credentials from LSASS memory on Windows endpoints. Which data source is most directly suited to detecting this behavior?

  1. Email gateway logs of blocked attachments
  2. Process access telemetry showing unusual handles opened to lsass.exe Correct answer.
  3. DNS query logs for newly registered domains
  4. NetFlow records of outbound traffic volume

Explanation

Credential dumping from LSASS typically requires a process to open a handle to lsass.exe with memory-read access, so endpoint process-access telemetry (for example Sysmon Event ID 10) is the most direct detection source. Network, DNS, and email logs may reveal follow-on activity but do not observe the memory-access behavior itself.

Question 37Threat Landscape and Threat Intelligence

Which framework organizes adversary behavior into tactics and techniques and is widely used to map detections to known adversary tradecraft?

  1. MITRE ATT&CK Correct answer.
  2. CVSS
  3. OWASP Top Ten
  4. NIST CSF

Explanation

MITRE ATT&CK is a curated knowledge base of adversary tactics and techniques based on real-world observations, and defenders use it to map coverage and detections. The other options address vulnerability severity, organizational security posture, and web application risk categories rather than adversary behavior.

Question 38Threat Landscape and Threat Intelligence

An organization wants to proactively hunt for threats that its existing controls have not detected. Which approach best characterizes threat hunting?

  1. Formulating a hypothesis about adversary behavior and searching telemetry to confirm or refute it Correct answer.
  2. Running an automated antivirus scan on a fixed schedule
  3. Waiting for an alert from the SIEM and then investigating it
  4. Reviewing firewall rules during a quarterly change window

Explanation

Threat hunting is an analyst-driven, hypothesis-based search through telemetry for evidence of activity that automated controls missed. It is proactive and iterative, distinguishing it from reactive alert triage and routine maintenance tasks.

Question 39Threat Landscape and Threat Intelligence

Which of the following best describes the Pyramid of Pain as applied to threat intelligence?

  1. It classifies vulnerabilities by exploitability and impact
  2. It grades the confidence level of intelligence sources
  3. It orders the phases of an incident response lifecycle
  4. It ranks indicator types by how much difficulty they cause an adversary when defenders detect and block them Correct answer.

Explanation

The Pyramid of Pain, introduced by David Bianco, arranges indicators from low-value atomic artifacts like hashes up to high-value TTPs, reflecting the increasing cost to an adversary when those indicators are denied. Defenders gain more lasting value by focusing on higher tiers such as tactics, techniques, and procedures.

Question 40Threat Landscape and Threat Intelligence

A file hash indicator appears in a threat feed. Which property most limits its long-term detection value against a determined adversary?

  1. Hashes are only meaningful for network traffic
  2. Hashes reveal the adversary's command-and-control infrastructure
  3. A trivial file modification changes the hash while preserving functionality Correct answer.
  4. Hashes cannot be computed for large files

Explanation

Cryptographic hashes are exact-match indicators, so an adversary can change a single byte or recompile the binary to produce a new hash that evades detection. This fragility is why hashes sit near the bottom of the Pyramid of Pain and are best combined with behavioral detections.

Question 41Threat Landscape and Threat Intelligence

Which intelligence source type is produced within an organization's own network from its own telemetry and logs?

  1. Dark web forum monitoring
  2. Internal telemetry Correct answer.
  3. Commercial threat feed
  4. ISAC bulletin

Explanation

Internal telemetry is first-party data generated by the organization's own sensors, endpoints, and network devices. Commercial feeds, ISAC bulletins, and dark web monitoring are external sources that provide third-party information.

Question 42Threat Landscape and Threat Intelligence

An analyst needs to enrich a suspicious domain indicator to determine when it was first registered and who registered it. Which resource is most appropriate?

  1. WHOIS and passive DNS records Correct answer.
  2. A SIEM correlation rule
  3. A CVSS calculator
  4. A YARA rule repository

Explanation

WHOIS provides domain registration details such as creation date and registrant information, while passive DNS shows historical resolution data that can reveal infrastructure relationships. Together they support enrichment and infrastructure analysis of a domain indicator.

Question 43Threat Landscape and Threat Intelligence

Which statement best explains why the Diamond Model of Intrusion Analysis is useful to threat-intelligence teams?

  1. It prescribes the sequence of containment steps after a breach
  2. It relates adversary, capability, infrastructure, and victim to describe an event and support pivoting Correct answer.
  3. It defines the legal thresholds for breach notification
  4. It scores the business impact of a data loss event

Explanation

The Diamond Model represents each intrusion event with four core features: adversary, capability, infrastructure, and victim, connected by relationships that analysts can pivot across. This structure supports activity tracking, attribution, and hypothesis development rather than prescribing response steps or legal thresholds.

Question 44Threat Landscape and Threat Intelligence

A threat report describes an actor as using 'living off the land' techniques. Which behavior does this most likely describe?

  1. Purchasing zero-day exploits from a broker
  2. Hosting command-and-control on bulletproof hosting providers
  3. Deploying custom malware compiled specifically for the target
  4. Abusing legitimate built-in system tools such as PowerShell or certutil to carry out malicious actions Correct answer.

Explanation

Living off the land refers to adversaries using legitimate, often pre-installed administrative tools and binaries to accomplish their objectives while blending with normal activity. This reduces the need for custom malware and makes behavior harder to distinguish from routine administration.

Question 45Threat Landscape and Threat Intelligence

Which of the following best distinguishes a structured threat-intelligence source from an unstructured one?

  1. Unstructured sources cannot contain indicators of compromise
  2. Structured sources are always more accurate than unstructured sources
  3. Structured sources use defined schemas and fields that can be parsed and queried automatically Correct answer.
  4. Structured sources are limited to machine-generated data only

Explanation

Structured intelligence follows a defined data model with typed fields, enabling automated parsing, correlation, and querying, as with STIX. Unstructured sources such as narrative reports can still contain valuable indicators but require manual or NLP-assisted extraction.

Question 46Threat Landscape and Threat Intelligence

A team wants to automate the retrieval of STIX-formatted intelligence from a sharing server. Which protocol is designed for transporting this content?

  1. MISP
  2. OpenIOC
  3. CybOX
  4. TAXII Correct answer.

Explanation

TAXII (Trusted Automated eXchange of Indicator Information) defines how threat-intelligence content such as STIX is exchanged over HTTPS between servers and clients. STIX provides the data representation, and TAXII provides the transport services.

Question 47Threat Landscape and Threat Intelligence

An analyst receives intelligence and must judge whether the source is reliable and the information is credible. Which scheme is conventionally used to express source reliability and information credibility separately?

  1. The CVSS vector
  2. The Cyber Kill Chain
  3. The ATT&CK matrix
  4. The Admiralty code Correct answer.

Explanation

The Admiralty code, also known as the NATO System, grades source reliability from A to F and information credibility from 1 to 6, producing a two-character rating such as B2. This separates trust in the source from confidence in the specific report.

Question 48Threat Landscape and Threat Intelligence

A threat feed reports that an actor uses a specific C2 domain, but the domain was registered only last week and has been seen in a single intrusion. How should an analyst treat this indicator?

  1. As a vulnerability that should be patched on all hosts
  2. As low-confidence and time-sensitive, warranting monitoring rather than immediate broad blocking Correct answer.
  3. As a definitive signature of the actor across all future campaigns
  4. As irrelevant because new domains are never malicious

Explanation

A newly registered domain observed in only one intrusion has limited corroboration, so confidence is low and the indicator may soon be abandoned by the adversary. Analysts should treat it as time-sensitive and validate before applying broad blocks that could disrupt legitimate activity.

Question 49Threat Landscape and Threat Intelligence

Which best explains the concept of 'course of action' in structured threat intelligence?

  1. The confidence score assigned to an intelligence source
  2. A recommended response that mitigates the risk described by the intelligence Correct answer.
  3. The sequence of techniques an adversary follows during an intrusion
  4. The transport channel used to share indicators

Explanation

In STIX, a Course of Action is an object representing an action that could be taken to prevent or respond to an attack, linked to relevant indicators or threat actors. It expresses a recommended mitigation rather than describing adversary behavior, source confidence, or transport.

Question 50Threat Landscape and Threat Intelligence

Which of the following is the best example of a behavioral indicator rather than an atomic one?

  1. An IPv4 address of a command-and-control server
  2. A process spawning from a word processor and making outbound connections shortly after document open Correct answer.
  3. An MD5 hash of a malicious binary
  4. A filename of a known malicious executable

Explanation

Behavioral indicators describe patterns of activity and context, such as a parent-child process relationship combined with network activity, making them more resistant to trivial evasion. Hashes, IP addresses, and filenames are atomic artifacts that adversaries can change easily.