I85PREP
⌘ K
TPFP TI study materials
TPFP TI study resources

TPFP TI practice questions

One question at a time. Build your TPFP TI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Threat Intelligence Fundamentals

Which statement best describes the primary purpose of cyber threat intelligence within an organization's security program?

  1. To replace vulnerability scanning by predicting future software defects
  2. To catalog every alert generated by endpoint detection tools for audit purposes
  3. To document the organization's internal IT asset inventory and ownership
  4. To provide decision-makers with analyzed, contextual knowledge about adversaries that informs defensive action Correct answer.

Explanation

Threat intelligence exists to reduce uncertainty for decision-makers by turning raw data about adversaries into contextual, actionable knowledge that guides defensive choices. It is not a logging function, a replacement for vulnerability management, or an asset register; those are separate security disciplines that may feed intelligence but do not define it.

Question 2Threat Intelligence Fundamentals

In the widely used intelligence hierarchy, which sequence correctly orders the levels from least to most processed?

  1. Data, intelligence, information
  2. Intelligence, information, data
  3. Information, data, intelligence
  4. Data, information, intelligence Correct answer.

Explanation

The hierarchy moves from raw data, to information once data is organized and given meaning, to intelligence once information is analyzed, contextualized, and made actionable for a specific decision. Each step adds interpretation and relevance rather than merely volume.

Question 3Threat Intelligence Fundamentals

A security team receives a feed of raw IP addresses observed scanning its perimeter. Which term best characterizes this material before any analysis is performed?

  1. Intelligence
  2. Assessment
  3. Estimate
  4. Data Correct answer.

Explanation

Raw observations such as unprocessed IP addresses are data; they gain meaning only after being organized into information and then analyzed into intelligence. An assessment or estimate is a finished analytic product, which this feed is not.

Question 4Threat Intelligence Fundamentals

Which pair correctly matches an intelligence level with its typical consumer?

  1. Operational intelligence with software vendors only
  2. Tactical intelligence with national policymakers
  3. Strategic intelligence with senior executives and boards Correct answer.
  4. Technical intelligence with public relations teams

Explanation

Strategic intelligence addresses long-term risk, adversary intent, and business impact, so it is consumed by executives and boards who set direction and allocate resources. The other levels serve different audiences: tactical and technical intelligence support defenders and analysts, while operational intelligence supports campaign-level planning.

Question 5Threat Intelligence Fundamentals

What distinguishes a threat actor from a threat vector?

  1. The actor is a network protocol, while the vector is the hardware carrying it
  2. The actor is the defensive control, while the vector is the gap it closes
  3. The actor is a software vulnerability, while the vector is the person exploiting it
  4. The actor is the entity conducting malicious activity, while the vector is the path or means used to deliver it Correct answer.

Explanation

A threat actor is the individual, group, or organization that carries out malicious activity, whereas a threat vector is the pathway or method, such as phishing email or a compromised VPN, through which the actor reaches the target. Keeping these distinct helps analysts describe who is attacking separately from how.

Question 6Threat Intelligence Fundamentals

Which characteristic is most closely associated with advanced persistent threat (APT) groups?

  1. Attacks limited to a single unpatched web server with no follow-on activity
  2. Automated scans that never establish a foothold
  3. Sustained, stealthy campaigns with significant resources and long-term objectives Correct answer.
  4. Short, opportunistic attacks aimed only at random individuals for quick profit

Explanation

APT groups are defined by persistence, stealth, resourcing, and strategic objectives sustained over long periods, often with nation-state or well-funded backing. Opportunistic quick-profit attacks and one-off scans lack the sustained, goal-directed character that defines an APT.

Question 7Threat Intelligence Fundamentals

What is the role of the intelligence cycle's 'dissemination' phase?

  1. Converting requirements into collection plans
  2. Destroying outdated indicators to reduce storage costs
  3. Delivering finished intelligence to the right consumers in a usable form and on time Correct answer.
  4. Collecting raw data from sensors and open sources

Explanation

Dissemination is the phase in which finished intelligence reaches the consumers who need it, in a form and timeframe that supports their decisions. Collection, planning and direction, and processing are separate phases that occur earlier in the cycle.

Question 8Threat Intelligence Fundamentals

Which source type is considered open-source intelligence (OSINT)?

  1. A private encrypted chat between two criminal actors
  2. Telemetry from a proprietary endpoint agent shared only internally
  3. A classified government cable obtained without authorization
  4. A publicly available vendor blog post describing a new malware family Correct answer.

Explanation

OSINT is derived from publicly available sources, so a public vendor blog post qualifies. Classified material, private criminal communications, and closed internal telemetry are not publicly accessible and therefore fall outside OSINT.

Question 9Threat Intelligence Fundamentals

An analyst must choose a framework for describing adversary behavior in a repeatable, structured way that links observed techniques to defensive coverage. Which framework is designed for that purpose?

  1. MITRE ATT&CK Correct answer.
  2. ISO 27001
  3. NIST SP 800-53
  4. PCI DSS

Explanation

MITRE ATT&CK catalogs adversary tactics and techniques observed in real intrusions, giving analysts a common vocabulary that maps behavior to detection and mitigation. PCI DSS, ISO 27001, and NIST SP 800-53 are control and compliance frameworks, not behavior taxonomies.

Question 10Threat Intelligence Fundamentals

In the Diamond Model of Intrusion Analysis, which four core features describe every intrusion event?

  1. Confidentiality, integrity, availability, accountability
  2. Source, destination, protocol, payload
  3. Actor, motive, opportunity, impact
  4. Adversary, capability, infrastructure, victim Correct answer.

Explanation

The Diamond Model represents each intrusion event with four vertices: adversary, capability, infrastructure, and victim, connected by edges that describe their relationships. Motive and opportunity are meta-features, while the other listed sets belong to risk or network analysis, not the Diamond Model.

Question 11Threat Intelligence Fundamentals

A report states that a campaign is 'attributed with moderate confidence' to a specific actor. What does this most accurately convey?

  1. The analytic judgment is supported by credible evidence but remains open to revision as new data arrives Correct answer.
  2. The campaign has been confirmed to be a false flag operation
  3. The report's authors have no evidence and are guessing
  4. The actor has been definitively proven responsible beyond doubt

Explanation

Confidence language communicates the strength of the analytic judgment, not certainty; moderate confidence means credible but incomplete or mixed evidence that could shift with new information. Definitive proof, absence of evidence, and false-flag conclusions each describe different epistemic states than moderate confidence.

Question 12Threat Intelligence Fundamentals

Which analytic practice best mitigates cognitive bias when assessing an adversary's likely next move?

  1. Delaying all analysis until perfect information is available
  2. Relying on a single senior analyst's intuition without documentation
  3. Structuring the assessment with competing hypotheses and actively seeking disconfirming evidence Correct answer.
  4. Selecting only sources that agree with the initial hypothesis

Explanation

Structured techniques such as analysis of competing hypotheses force analysts to weigh alternative explanations and seek evidence that could disprove their favored view, reducing confirmation bias. Cherry-picking sources, undocumented intuition, and waiting for perfect information all increase error or paralysis.

Question 13Threat Intelligence Fundamentals

An indicator of compromise (IOC) is best described as which of the following?

  1. A vulnerability score assigned by a scanning tool
  2. A policy defining acceptable use of corporate assets
  3. A prediction of an adversary's future strategic intent
  4. An observable artifact suggesting a system may already be compromised Correct answer.

Explanation

IOCs are forensic observables, such as malicious file hashes, domains, or registry keys, that suggest a compromise may have occurred. They are retrospective evidence, not strategic forecasts, policies, or vulnerability ratings.

Question 14Threat Intelligence Fundamentals

Why are IOCs considered to have a shorter useful lifespan than TTPs (tactics, techniques, and procedures)?

  1. IOCs are easily changed by adversaries, whereas TTPs reflect enduring behavioral patterns Correct answer.
  2. IOCs are classified information while TTPs are always public
  3. IOCs describe intent while TTPs describe only infrastructure
  4. TTPs expire automatically after thirty days while IOCs never do

Explanation

Indicators such as IPs, domains, and hashes are cheap for adversaries to rotate, so their detection value decays quickly. TTPs describe how adversaries operate and persist across campaigns, making them more durable for detection and defense.

Question 15Threat Intelligence Fundamentals

Which product is most appropriate for a security operations center that needs machine-readable indicators to automatically block known-bad domains at the perimeter?

  1. A structured threat intelligence feed of indicators in a machine-readable format Correct answer.
  2. A strategic intelligence briefing for the board of directors
  3. An annual penetration test summary
  4. A vulnerability disclosure report from a researcher

Explanation

Automated blocking requires machine-readable, structured indicator feeds that perimeter tools can ingest and act on directly. Board briefings, disclosure reports, and penetration test summaries are narrative or point-in-time products not designed for automated enforcement.

Question 16Threat Intelligence Fundamentals

A team wants to assess whether a suspicious file is malicious using multiple public analysis services and correlate their reports. Which approach best reflects sound intelligence tradecraft?

  1. Discard any report that conflicts with the initial assumption
  2. Corroborate findings across independent sources and note where they disagree Correct answer.
  3. Publish the file hash publicly before any analysis is complete
  4. Trust the first service that returns a verdict and ignore the rest

Explanation

Sound tradecraft requires corroboration across independent sources and explicit attention to disagreement, because single-source verdicts can be wrong or stale. Trusting the first result, discarding conflicting evidence, and premature publication all undermine analytic integrity.

Question 17Threat Intelligence Fundamentals

Which statement correctly distinguishes tactical from operational threat intelligence?

  1. Tactical intelligence is only for executives, while operational intelligence is only for regulators
  2. Tactical intelligence focuses on immediate adversary techniques and indicators, while operational intelligence addresses specific ongoing campaigns and operations Correct answer.
  3. Tactical intelligence is classified, while operational intelligence is always public
  4. Tactical intelligence covers years of adversary strategy, while operational intelligence covers only software patches

Explanation

Tactical intelligence supports day-to-day defense with details about techniques and indicators, while operational intelligence provides insight into specific campaigns or operations and how they are conducted. The distinction is about scope and consumer, not classification or executive versus regulator audiences.

Question 18Threat Intelligence Fundamentals

What is the main risk of relying solely on a single commercial threat intelligence vendor's feed?

  1. Inability to ever integrate the feed with security tools
  2. Guaranteed legal liability for the vendor's errors
  3. Automatic loss of all network connectivity
  4. Limited visibility and potential shared blind spots or bias from one source Correct answer.

Explanation

Single-source dependence narrows coverage and imports that vendor's collection gaps and analytic biases into the organization's view of the threat landscape. Diversifying sources and validating independently reduces shared blind spots; the other outcomes are not inherent consequences.

Question 19Threat Intelligence Fundamentals

An analyst receives a tip from an anonymous forum user claiming a specific company will be attacked next week. What is the most appropriate first step?

  1. Assume the claim is a hoax and close the case
  2. Assess the source's credibility and corroborate the claim with independent evidence before acting Correct answer.
  3. Immediately publish the warning to all customers without verification
  4. Dismiss the tip solely because the source is anonymous

Explanation

Unverified tips must be evaluated for source credibility and corroborated before they drive action or disclosure, since acting on a single anonymous claim can cause unwarranted alarm or error. Dismissing it outright or assuming a hoax ignores potentially useful information.

Question 20Threat Intelligence Fundamentals

Which collection discipline would best provide insight into adversary communications occurring on closed criminal forums?

  1. MASINT from physical sensor measurements
  2. HUMINT through human sources and covert engagement Correct answer.
  3. OSINT from public news websites
  4. IMINT from satellite imagery

Explanation

Closed forums require human-source tradecraft, such as HUMINT, because access depends on relationships and trust rather than public availability. OSINT covers public sources, while IMINT and MASINT collect imagery and physical measurement data irrelevant to forum communications.

Question 21Threat Intelligence Fundamentals

During the intelligence cycle, what is the purpose of the 'processing and exploitation' phase?

  1. Evaluating whether the overall program meets its budget
  2. Delivering final reports to decision-makers
  3. Converting collected raw data into a form analysts can use, such as translating, decoding, or normalizing it Correct answer.
  4. Setting intelligence requirements with stakeholders

Explanation

Processing and exploitation transforms raw collected data, through translation, decryption, normalization, or parsing, into a usable form for analysis. Requirements setting, dissemination, and program budgeting belong to other phases or management activities.

Question 22Threat Intelligence Fundamentals

An analyst observes that a malware sample's command-and-control domain was registered through a privacy service two days before the campaign began and shares a TLS certificate with three other suspected domains. Which analytic conclusion is best supported?

  1. The domains are benign because privacy registration is common
  2. The domains are definitively operated by a specific named nation-state group
  3. The shared certificate proves the domains are unrelated
  4. The domains are likely part of a common infrastructure cluster, warranting further pivoting on the shared certificate Correct answer.

Explanation

Shared certificates and coordinated registration timing are infrastructure commonalities that support hypothesizing a linked cluster, which analysts can then pivot on and validate. Such technical links do not by themselves prove nation-state attribution, benignity, or lack of relationship.

Question 23Threat Intelligence Fundamentals

A defender must decide whether to block an IP address that appears in a low-confidence, recently created feed and also hosts a legitimate shared service. Which course of action best reflects sound intelligence-driven decision-making?

  1. Ignore all feeds because one false positive invalidates the source
  2. Weigh the indicator's confidence and potential business impact, and consider narrower controls such as monitoring before blocking Correct answer.
  3. Block the IP immediately because any feed inclusion justifies a permanent block
  4. Report the feed vendor to regulators for providing low-confidence data

Explanation

Intelligence-driven decisions balance indicator confidence against operational impact, and shared hosting raises the risk of collateral disruption, so graduated responses like monitoring or scoped blocking are appropriate. Immediate permanent blocking, wholesale rejection of feeds, and regulatory complaints are disproportionate responses.

Question 24Threat Intelligence Fundamentals

Two reports describe the same intrusion. One names the actor using vendor-specific nomenclature, the other uses a government designation. What is the most rigorous way to handle this in an intelligence product?

  1. Conclude the reports describe different actors because the names differ
  2. Merge the actor names without documenting the mapping rationale
  3. Map both names to a common tracking convention and note the aliases and the basis for the linkage Correct answer.
  4. Choose the more familiar name and omit the other to avoid confusion

Explanation

Actor naming is not standardized across vendors and governments, so rigorous products map aliases to a common convention and document the evidentiary basis for treating them as the same group. Omitting aliases, assuming different actors from different names, or merging without rationale degrades clarity and traceability.

Question 25Threat Intelligence Fundamentals

An organization's intelligence program produces voluminous reports that decision-makers rarely read. Which change most directly addresses this failure?

  1. Restrict distribution to the security team only
  2. Tailor products to specific consumer requirements and decision timelines Correct answer.
  3. Increase report length to include every collected indicator
  4. Reduce the number of analysts producing reports

Explanation

Intelligence must be relevant and timely for its consumers; tailoring products to defined requirements and decision cycles improves use and impact. Adding volume, cutting analysts, or narrowing distribution does not fix the mismatch between product and consumer need.

Question 26Threat Intelligence Fundamentals

Which statement best defines threat intelligence as distinguished from raw data?

  1. It is the list of software vulnerabilities published by a vendor in a monthly advisory
  2. It is data that has been collected, processed, and analyzed to answer a specific decision-maker's question about threats Correct answer.
  3. It is the set of firewall rules an organization applies to block known malicious addresses
  4. It is any log or alert collected by a SIEM and stored for later review

Explanation

Threat intelligence is not raw collection; it is the output of applying context, analysis, and relevance to data so that a specific decision can be informed. Logs, advisories, and blocklists are inputs or products of security operations, but only become intelligence once analyzed against a consumer's requirements.

Question 27Threat Intelligence Fundamentals

An analyst is asked to classify a report by its intended consumer. Which pairing of intelligence level to consumer is most accurate?

  1. Technical intelligence is consumed by executives to set risk appetite
  2. Strategic intelligence is consumed by SOC analysts tuning detection rules
  3. Tactical intelligence is consumed by the board of directors for budget decisions
  4. Operational intelligence is consumed by campaign-level planners who need to understand adversary intent and timing Correct answer.

Explanation

Operational intelligence addresses adversary campaigns and intent, supporting those who plan defenses over weeks to months rather than single alerts. Strategic intelligence serves senior leadership, while tactical and technical intelligence serve hands-on defenders. Matching the level to the consumer's decision horizon is the core of the classification.

Question 28Threat Intelligence Fundamentals

A newly formed intelligence team must first define what decisions its products will support. Which intelligence cycle phase does this activity belong to?

  1. Direction Correct answer.
  2. Analysis
  3. Dissemination
  4. Collection

Explanation

Direction is the phase in which requirements are set by identifying the decisions intelligence must support and prioritizing them. Collection only begins once those requirements exist, and analysis and dissemination follow later in the cycle. Skipping direction is a common cause of intelligence that is accurate but irrelevant.

Question 29Threat Intelligence Fundamentals

Which statement correctly describes the relationship between data, information, and intelligence?

  1. Data is analyzed findings, information is raw observations, and intelligence is stored logs
  2. Intelligence is raw observations, information is finished reporting, and data is the final product
  3. Data, information, and intelligence are interchangeable terms for the same collected facts
  4. Data is raw observations, information is data placed in context, and intelligence is information analyzed for a decision Correct answer.

Explanation

The progression runs from raw observations (data) to contextualized facts (information) to analyzed, decision-relevant conclusions (intelligence). Each step adds interpretation and relevance rather than simply more volume. Treating the terms as synonyms obscures why intelligence requires analysis.

Question 30Threat Intelligence Fundamentals

A SOC receives a feed containing hundreds of IP addresses with no context, and analysts must decide which to block. Which enrichment step most improves the feed's value as intelligence?

  1. Adding fields such as first-seen date, associated malware family, and hosting type for each address Correct answer.
  2. Increasing the refresh rate of the feed to every minute
  3. Storing the addresses in a separate database without linking them to incidents
  4. Removing all addresses that have not appeared in the last hour

Explanation

Context such as age, malware association, and hosting type lets analysts judge whether an address is a targeted threat or shared infrastructure, which changes the blocking decision. Faster refresh or storage alone does not add meaning. Enrichment converts an indicator list into something a defender can reason about.

Question 31Threat Intelligence Fundamentals

An analyst must document the confidence behind a judgment that an intrusion used a specific tool. Which practice most improves the rigor of that judgment?

  1. Stating the judgment with no supporting detail so it cannot be challenged
  2. Listing the specific evidence and reasoning that link the observation to the conclusion, along with a confidence level Correct answer.
  3. Removing all uncertainty language so the report reads decisively
  4. Relying on a single source because corroboration adds complexity

Explanation

Structured analytic standards require that judgments be traceable to evidence and that confidence be stated explicitly, so consumers can weigh the conclusion appropriately. Decisive wording without evidence does not increase accuracy. Corroboration across independent sources strengthens confidence rather than complicating it.

Question 32Threat Intelligence Fundamentals

A threat intelligence platform must ingest indicators in a structured, machine-readable format that expresses relationships between observables. Which standard is designed for that purpose?

  1. YARA
  2. MITRE ATT&CK
  3. Snort
  4. STIX Correct answer.

Explanation

STIX is a structured language for representing cyber threat information, including observables and the relationships among them, and is commonly paired with TAXII for transport. YARA and Snort are detection rule formats, and ATT&CK is a knowledge base of adversary behaviors rather than a data-exchange schema.

Question 33Threat Intelligence Fundamentals

An organization wants to share indicators with trusted partners while controlling who can access them and under what handling rules. Which mechanism best supports this?

  1. Emailing an unstructured spreadsheet to every contact in the address book
  2. Posting indicators to a general social media account
  3. Publishing the indicators on a public website with no access controls
  4. A sharing community with defined membership, marking, and transport such as TAXII channels Correct answer.

Explanation

Trusted sharing requires controlled membership, handling markings, and a defined transport so that recipients are known and obligations are clear. TAXII channels and community agreements provide exactly that structure. Uncontrolled publication removes the ability to enforce handling restrictions.

Question 34Threat Intelligence Fundamentals

An analyst needs to describe an adversary's known behaviors so defenders can map their coverage against them. Which resource is most appropriate?

  1. A list of file hashes observed in the wild
  2. A registry of domain name registrars
  3. A curated knowledge base of adversary tactics and techniques Correct answer.
  4. A vulnerability severity scoring system

Explanation

A curated knowledge base of tactics and techniques, such as ATT&CK, organizes observed adversary behavior so defenders can assess whether their detection and mitigation cover those behaviors. Hash lists and scoring systems address different questions. Behavior mapping requires a structured catalog of techniques.

Question 35Threat Intelligence Fundamentals

A report describes an intrusion using the Diamond Model, noting that the adversary used a phishing email to gain access to a victim's workstation. Which two vertices of the model does this event describe?

  1. Adversary and capability
  2. Infrastructure and victim
  3. Capability and infrastructure
  4. Adversary and victim Correct answer.

Explanation

In the Diamond Model the four vertices are adversary, capability, infrastructure, and victim, and an event connects an adversary to a victim. A phishing email used against a workstation describes the actor and the target, while the email itself and the sending infrastructure would be capability and infrastructure.

Question 36Threat Intelligence Fundamentals

An analyst finds a malware sample whose configuration contains a hard-coded fallback IP address and a domain generation algorithm. Which analytic conclusion is best supported?

  1. Blocking only the hard-coded IP will fully neutralize the malware's command and control
  2. The domain generation algorithm indicates the malware is inactive and can be ignored
  3. The fallback IP is irrelevant because it appears only once in the configuration
  4. The malware can likely recover command and control through multiple paths, so defenses should address the algorithm and the fallback together Correct answer.

Explanation

Hard-coded fallback infrastructure combined with a domain generation algorithm gives the malware redundant means to reach command and control. Effective defense therefore needs to address both the generated domains and the static fallback rather than a single indicator. Single-indicator blocking leaves the alternative path open.

Question 37Threat Intelligence Fundamentals

Two feeds report the same malicious domain, but one is a curated feed with documented sourcing and the other is an automated scrape with no provenance. How should the analyst weigh these reports?

  1. Weight the curated feed more heavily and seek independent confirmation before raising confidence Correct answer.
  2. Discard both because they disagree on the domain's significance
  3. Treat them as independent corroboration because two sources reported the domain
  4. Average the two by ignoring sourcing entirely

Explanation

Corroboration requires independent sourcing; if the automated scrape simply copied the curated feed, counting it twice inflates confidence falsely. Provenance and documented collection methods determine how much weight a report deserves. Independent confirmation is what actually raises confidence.

Question 38Threat Intelligence Fundamentals

A defender is deciding whether to deploy a detection rule based on a technique observed in only one intrusion attributed with low confidence. Which approach best reflects sound intelligence practice?

  1. Deploy the rule as a high-severity alert without noting the confidence
  2. Publish the technique as a confirmed capability of the actor
  3. Reject the observation entirely because confidence is low
  4. Treat the observation as a hypothesis, validate it against additional data, and set detection priority accordingly Correct answer.

Explanation

Low-confidence observations are useful as hypotheses that guide further collection and validation, not as established facts. Calibrating detection priority to confidence avoids both alert fatigue and wasted effort. Validation against additional data is what converts a tentative observation into a reliable judgment.

Question 39Threat Intelligence Fundamentals

Which activity belongs to the collection phase of the intelligence cycle rather than to analysis?

  1. Writing a confidence statement for a finished product
  2. Gathering posts from a monitored forum and archiving them for later review Correct answer.
  3. Assessing whether a forum post is credible
  4. Comparing two reports to determine which actor is responsible

Explanation

Collection is the acquisition of raw data against established requirements, such as harvesting and archiving forum content. Credibility assessment, comparison of reports, and confidence statements are analytic activities performed on collected material. Keeping the phases distinct helps ensure collection is driven by requirements.

Question 40Threat Intelligence Fundamentals

A team wants its finished intelligence to be actionable for decision-makers. Which characteristic matters most?

  1. Use of as much technical jargon as possible to signal expertise
  2. Publication on the widest possible distribution list
  3. Maximum length so that all collected detail is preserved
  4. Relevance to a stated requirement, with clear implications and recommended actions Correct answer.

Explanation

Actionable intelligence answers a specific requirement and makes the implications and options clear to the consumer. Volume, jargon, and broad distribution do not improve actionability and can obscure the key judgment. Tailoring the product to the decision at hand is what makes it useful.

Question 41Threat Data Collection and Sources

TI（Threat Intelligence）の情報源を、収集手段の観点で「OSINT」と「HUMINT」に分けるとき、HUMINTに該当するものはどれか。

  1. マルウェア検体のサンドボックス実行ログ
  2. 公開されている脆弱性データベースの巡回
  3. フォーラムに潜伏して得た攻撃者との直接対話 Correct answer.
  4. 自組織のファイアウォールによる通信記録

Explanation

HUMINTは人間を介した情報収集であり、攻撃者コミュニティへの参加や直接対話、内部関係者への聞き取りなどが該当する。公開情報の巡回はOSINT、検体実行や自組織のログは技術的テレメトリに分類される。

Question 42Threat Data Collection and Sources

STIX 2.1において、あるキャンペーンとそのキャンペーンで使用されたマルウェアを関連付けるために用いる関係オブジェクトはどれか。

  1. Relationship Correct answer.
  2. Bundle
  3. Observed-Data
  4. Indicator

Explanation

STIXではSDO間の意味的なつながりをRelationshipオブジェクトで表現し、relationship_typeにusesなどを指定してキャンペーンとマルウェアを結び付ける。IndicatorやObserved-Dataは検知パターンや観測事実を表すオブジェクトであり、関係そのものを表すものではない。

Question 43Threat Data Collection and Sources

TAXII 2.1のコレクションからSTIXデータを取得する際、前回取得以降の差分のみを効率的に得るためにクライアントが用いる仕組みはどれか。

  1. HTTPのDELETEメソッドによる同期
  2. Content-Typeのネゴシエーション
  3. added_afterパラメータによるフィルタ Correct answer.
  4. Server-Sent Eventsによる全件再送

Explanation

TAXII 2.1ではadded_afterクエリパラメータを使い、指定日時以降に追加されたオブジェクトだけを取得できるため、ポーリング時の差分同期に適する。Content-Typeの交渉はデータ形式の合意、DELETEは削除要求であり、差分取得の手段ではない。

Question 44Threat Data Collection and Sources

MISPにおいて、複数の組織間でインジケータを共有する際に、共有範囲を「このコミュニティ内のみ」に制限する分布設定はどれか。

  1. This community only Correct answer.
  2. All communities
  3. Connected communities
  4. Your organisation only

Explanation

MISPのdistribution設定は共有範囲を段階的に制御し、This community onlyは同一インスタンス上でつながるコミュニティ内に限定してイベントを共有する。Your organisation onlyは自組織限定、Connected communitiesやAll communitiesはより広い範囲への共有となる。

Question 45Threat Data Collection and Sources

商用脅威インテリジェンスと無償のOSINTを比較したとき、商用サービスが一般的に提供する付加価値として最も適切なものはどれか。

  1. アナリストによる文脈付けと帰属評価 Correct answer.
  2. 広告収益に依存した継続的な無償提供
  3. 収集した全生データの無加工公開
  4. 匿名化されない被害組織名の公表

Explanation

商用TIは単なるデータ提供にとどまらず、アナリストが攻撃者の意図や帰属、推奨対策を文脈付きで評価して提供する点に価値がある。生データの無加工公開や無償提供は商用サービスの一般的な特性ではない。

Question 46Threat Data Collection and Sources

脆弱性情報源としてのNVDを利用する際、CVEレコードにCVSSスコアが付与されていない場合に補完情報として参照できるものはどれか。

  1. CVE Programの予約ID一覧
  2. IANAのポート番号レジストリ
  3. CISAのKEVカタログにある悪用確認情報 Correct answer.
  4. W3CのHTML仕様

Explanation

CVSSスコアが未付与でも、CISAのKEVカタログに掲載されていれば実際に悪用された脆弱性であることが分かり、優先順位付けの判断材料になる。CVE ID一覧やポート番号レジストリは深刻度の補完情報にはならない。

Question 47Threat Data Collection and Sources

ダークウェブ上のフォーラムから情報を収集する際、収集担当者が最初に確認すべき統制として最も適切なものはどれか。

  1. 取得した個人情報をそのまま社内共有する
  2. 法務・倫理レビューと収集範囲の事前承認を得る Correct answer.
  3. 身元を偽って違法取引に参加する
  4. 収集した会話ログを無期限に全件保存する

Explanation

ダークウェブ収集は法的・倫理的なリスクが高く、事前に法務や倫理のレビューを受け、収集目的と範囲を承認された手続きに沿って定めることが前提となる。無制限保存や違法取引への参加、個人情報の無制限共有は統制違反となる。

Question 48Threat Data Collection and Sources

ある組織が、同じ攻撃者グループについて複数のインテリジェンス提供元から異なる名称の付与を受けている場合、名称の対応関係を整理するために参照すべきものはどれか。

  1. MITRE ATT&CKのグループページにある別名の記載 Correct answer.
  2. CVSSの基本スコア
  3. TLPの色分け
  4. WHOISの登録者情報

Explanation

MITRE ATT&CKのグループページには、各ベンダーが付けた別名が併記されており、提供元ごとに異なるグループ名の対応を整理できる。CVSSは脆弱性の深刻度、TLPは共有範囲、WHOISはドメイン登録情報であり、名称対応の整理には使えない。

Question 49Threat Data Collection and Sources

脅威インテリジェンスの収集計画において、Priority Intelligence Requirements（PIR）を定める主な目的はどれか。

  1. 収集したデータの保存期間を延ばす
  2. インシデント対応の手順書を自動生成する
  3. すべての公開情報を漏れなく収集する
  4. 収集対象の優先順位を明確にし、判断に必要な情報を絞り込む Correct answer.

Explanation

PIRは意思決定者が抱える重要な情報要求を明示し、限られた収集リソースをどの情報に振り向けるかを決めるための枠組みである。全件収集や保存期間の延長、手順書の自動生成を目的とするものではない。

Question 50Threat Data Collection and Sources

受動的DNS（pDNS）のデータを脅威調査に用いる利点として最も適切なものはどれか。

  1. 攻撃者に検知されることなく過去の名前解決履歴を確認できる Correct answer.
  2. 暗号化された通信内容を復号して閲覧できる
  3. ドメインの現在の登録者を法的に特定できる
  4. マルウェアの検体を取得して実行できる

Explanation

受動的DNSはリゾルバで観測された名前解決の履歴を蓄積したもので、対象インフラに直接問い合わせずに過去の関連付けを調べられる。登録者の特定や通信内容の復号、検体取得はpDNSの機能ではない。