I85PREP
⌘ K
SIDC Module 14 study materials
SIDC Module 14 study resources

SIDC Module 14 practice questions

One question at a time. Build your SIDC Module 14 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Unverified content domain (source does not enumerate domains for this module)

In the SIDC framework, what does the term 'indicator' most precisely refer to?

  1. A patch management schedule applied to production servers
  2. A technical artefact or observable that suggests a potential compromise or malicious activity Correct answer.
  3. A legal notification sent to a regulator after a breach
  4. A confirmed attribution of an attack to a specific threat actor group

Explanation

An indicator is an observable artefact such as a file hash, IP address, domain, or registry key that suggests possible malicious activity. It is evidence of potential compromise, not proof of who is responsible or a legal or operational process.

Question 2Unverified content domain (source does not enumerate domains for this module)

Which characteristic best distinguishes a 'strategic' threat intelligence product from an operational one?

  1. It is produced exclusively by law enforcement agencies
  2. It contains only machine-readable STIX objects for automated ingestion
  3. It lists raw IP addresses and file hashes for immediate blocking
  4. It addresses long-term trends, risks, and decision-making for senior leadership Correct answer.

Explanation

Strategic intelligence is aimed at senior decision-makers and concerns long-term trends, risks, and the threat landscape rather than immediate technical response. Operational and tactical products focus on specific campaigns and concrete observables used by defenders.

Question 3Unverified content domain (source does not enumerate domains for this module)

What is the primary purpose of the 'Direction' phase in the intelligence cycle as applied to SIDC work?

  1. Defining priority intelligence requirements that guide collection Correct answer.
  2. Converting raw logs into STIX 2.1 bundles
  3. Encrypting intelligence reports before distribution
  4. Deleting indicators that have exceeded their retention period

Explanation

Direction sets the priority intelligence requirements that determine what needs to be collected and why. Without clear requirements, collection and analysis lack focus and produce intelligence that does not serve decision-makers.

Question 4Unverified content domain (source does not enumerate domains for this module)

An analyst finds a file hash that appears in a public malware repository. Which statement about using this hash as an indicator is most accurate?

  1. The hash is definitive proof that any host containing the file is compromised by that malware family
  2. The hash is a strong technical indicator but should be corroborated with context such as behaviour and prevalence Correct answer.
  3. The hash can never be used because public repositories are untrustworthy
  4. The hash should be blocked only after law enforcement authorisation

Explanation

A matching hash is a useful technical indicator, but effective analysis corroborates it with behavioural context, prevalence, and environmental relevance. Hashes can also be shared by benign or dual-use files, so a match alone is not definitive proof of compromise.

Question 5Unverified content domain (source does not enumerate domains for this module)

In the Traffic Light Protocol (TLP), what does the TLP:RED marking mean for sharing?

  1. The information may be shared with any government agency without restriction
  2. The information may be shared freely with the public
  3. The information may be shared within the recipient's entire industry sector
  4. The information is restricted to the named recipients only Correct answer.

Explanation

TLP:RED restricts information to the specific individuals named as recipients, typically for in-person or closed-channel exchange. It is the most restrictive marking and does not permit wider redistribution without the originator's consent.

Question 6Unverified content domain (source does not enumerate domains for this module)

Which of the following best describes a 'campaign' in structured threat intelligence?

  1. A firewall rule set applied to a network segment
  2. A single piece of malware detected on one endpoint
  3. A vulnerability score assigned by a scoring system
  4. A grouping of related adversary activity sharing objectives, infrastructure, or timing Correct answer.

Explanation

A campaign groups related adversary activity that shares objectives, infrastructure, or timing, allowing analysts to connect separate incidents. It is an analytic construct that links incidents rather than a single artefact or a defensive configuration.

Question 7Unverified content domain (source does not enumerate domains for this module)

What is the main benefit of expressing threat intelligence in a structured, machine-readable format such as STIX?

  1. It encrypts intelligence so only the originator can read it
  2. It enables automated sharing and correlation of intelligence between tools and organisations Correct answer.
  3. It guarantees the intelligence is accurate and free from bias
  4. It replaces the need for human analysts entirely

Explanation

Structured formats allow tools and organisations to exchange and correlate intelligence consistently and automatically. They standardise representation but do not guarantee accuracy, replace analysts, or provide encryption.

Question 8Unverified content domain (source does not enumerate domains for this module)

Which statement best captures the difference between a 'vulnerability' and an 'exploit' in SIDC reporting?

  1. A vulnerability is a weakness; an exploit is a technique or code that leverages it Correct answer.
  2. A vulnerability is a legal term; an exploit is a detection rule
  3. A vulnerability is malicious code; an exploit is the patch that removes it
  4. A vulnerability is an indicator of compromise; an exploit is a threat actor

Explanation

A vulnerability is a weakness in software, configuration, or process, while an exploit is the technique or code that takes advantage of that weakness. Keeping the terms distinct prevents confusion when prioritising remediation versus detecting attacks.

Question 9Unverified content domain (source does not enumerate domains for this module)

A defender receives a feed of indicators and wants to reduce false positives. Which approach best reflects sound SIDC practice?

  1. Discard all indicators older than one day regardless of context
  2. Score indicators by confidence, recency, and relevance to the organisation's environment before use Correct answer.
  3. Block every indicator immediately to maximise coverage
  4. Apply indicators only to servers, never to endpoints

Explanation

Effective use of indicators requires prioritisation based on confidence, recency, and environmental relevance so that defensive action targets the most meaningful threats. Immediate blanket blocking or arbitrary age cut-offs ignore context and can degrade operations.

Question 10Unverified content domain (source does not enumerate domains for this module)

During analysis an analyst observes a domain resolving to an IP address that has also hosted benign services. What is the most defensible analytic conclusion?

  1. The domain is definitively malicious because of the shared IP
  2. The IP address should be permanently blocklisted without further review
  3. The observation is irrelevant and should be discarded
  4. Shared infrastructure is common; the domain requires additional corroborating evidence Correct answer.

Explanation

Shared hosting means malicious and benign domains frequently reuse the same IP addresses, so infrastructure overlap alone is weak evidence. Analysts should seek corroboration such as registration patterns, content, or behavioural telemetry before concluding maliciousness.

Question 11Unverified content domain (source does not enumerate domains for this module)

An intelligence requirement asks whether a specific sector is being targeted by ransomware operators. Which collection approach best serves this requirement?

  1. Collecting only internal firewall logs from the last hour
  2. Reviewing the organisation's acceptable use policy
  3. Combining external reporting, dark web monitoring, and internal incident data over a relevant period Correct answer.
  4. Requesting a penetration test of a single web application

Explanation

Answering a sector-targeting question requires multiple sources over a meaningful period, blending external reporting, underground monitoring, and internal incident data. A narrow single source or an unrelated policy review cannot support a sector-level judgement.

Question 12Unverified content domain (source does not enumerate domains for this module)

What does the 'diamond model' primarily help an analyst do?

  1. Encrypt intelligence reports before sharing
  2. Relate adversary, capability, infrastructure, and victim to analyse an intrusion event Correct answer.
  3. Assign TLP markings to a report
  4. Calculate a CVSS base score for a vulnerability

Explanation

The diamond model frames an intrusion event around four core features: adversary, capability, infrastructure, and victim, allowing analysts to relate and pivot across them. It is an analytic framework, not a scoring, encryption, or marking system.

Question 13Unverified content domain (source does not enumerate domains for this module)

An analyst wants to pivot from a known malicious file hash to related infrastructure. Which action best follows structured analytic practice?

  1. Search malware repositories and sandbox reports for the hash to identify contacted domains and IPs Correct answer.
  2. Immediately block the hash and close the investigation
  3. Delete the file and document that no further analysis was possible
  4. Report the hash to law enforcement and take no further action

Explanation

Pivoting means using one known artefact to discover related artefacts, so searching repositories and sandbox reports for contacted infrastructure is the correct next step. Closing the investigation or deleting evidence prematurely prevents the discovery of linked indicators.

Question 14Unverified content domain (source does not enumerate domains for this module)

Which practice best supports confidence assessment when producing a SIDC intelligence report?

  1. Relying on a single uncorroborated source for speed
  2. Presenting all findings with equal certainty to avoid confusion
  3. Explicitly stating the confidence level and the evidence or gaps behind it Correct answer.
  4. Omitting source information to protect the report's brevity

Explanation

Confidence statements should be explicit and tied to the underlying evidence and known gaps so decision-makers can weigh the findings appropriately. Uniform certainty or hidden sourcing misleads readers and undermines trust in the assessment.

Question 15Unverified content domain (source does not enumerate domains for this module)

What is the role of 'dissemination' in the intelligence cycle, and what common pitfall should be avoided?

  1. Storing all intelligence in a central archive and never distributing it
  2. Sending every report to every employee to maximise awareness
  3. Publishing raw indicators publicly to crowdsource validation
  4. Delivering intelligence to the right recipients in a usable form, while avoiding over-distribution that breaches sharing restrictions Correct answer.

Explanation

Dissemination delivers finished intelligence to the appropriate recipients in a usable format, respecting sharing restrictions such as TLP. Over-distribution is a common pitfall because it can breach handling caveats and expose sensitive sources.

Question 16Unverified content domain (source does not enumerate domains for this module)

An analyst is asked to assess the credibility of a threat report from an unfamiliar vendor. Which factor is most relevant to the assessment?

  1. Whether the claims are supported by cited evidence and reproducible technical detail Correct answer.
  2. The number of pages in the document
  3. Whether the vendor's name sounds authoritative
  4. The visual design quality of the report

Explanation

Credibility depends on whether claims are supported by cited evidence and reproducible technical detail that others can verify. Presentation quality, length, and brand impression are superficial signals that do not establish analytic reliability.

Question 17Unverified content domain (source does not enumerate domains for this module)

Which statement best explains why indicator 'decay' matters in SIDC operations?

  1. Indicators must be deleted exactly 24 hours after creation by regulation
  2. Indicators often lose relevance as adversaries change infrastructure, so ageing feeds can cause false positives Correct answer.
  3. Indicators become more valuable over time as more systems adopt them
  4. Indicator decay only affects strategic intelligence

Explanation

Adversaries rotate infrastructure and tooling, so indicators frequently lose relevance over time and stale feeds can produce false positives. Managing decay means reviewing age and confidence so detection content stays effective rather than accumulating noise.

Question 18Unverified content domain (source does not enumerate domains for this module)

An organisation receives intelligence marked TLP:AMBER+STRICT. What is the correct handling behaviour?

  1. Share it with the whole organisation and trusted partners
  2. Publish it on a public threat-sharing platform
  3. Share it only with competitors in the same sector
  4. Restrict it to the recipient organisation only, without sharing to partners Correct answer.

Explanation

TLP:AMBER+STRICT limits sharing to the recipient organisation itself, with no onward sharing to partners. Standard TLP:AMBER permits sharing within the recipient's organisation and with clients or partners on a need-to-know basis, so the STRICT qualifier narrows that.

Question 19Unverified content domain (source does not enumerate domains for this module)

Which analytic technique best mitigates cognitive bias when assessing an adversary's likely next action?

  1. Selecting the first plausible hypothesis and building the report around it
  2. Applying structured techniques such as analysis of competing hypotheses Correct answer.
  3. Relying solely on the most recent incident to predict future behaviour
  4. Deferring to the most senior analyst without review

Explanation

Analysis of competing hypotheses forces analysts to evaluate multiple explanations against evidence, reducing anchoring and confirmation bias. Committing to the first plausible hypothesis or relying on recency or seniority leaves biases unchecked.

Question 20Unverified content domain (source does not enumerate domains for this module)

What does a 'priority intelligence requirement' (PIR) define in a SIDC programme?

  1. The maximum number of indicators a feed may contain
  2. The specific questions leadership needs answered to support decisions Correct answer.
  3. The encryption standard used for intelligence transfer
  4. The retention period for raw packet captures

Explanation

A PIR states the specific questions decision-makers need answered, directing collection and analysis toward relevant intelligence. It is a requirements statement, not a technical limit, encryption standard, or retention rule.

Question 21Unverified content domain (source does not enumerate domains for this module)

Why is 'context' considered essential when turning an indicator into actionable intelligence?

  1. Context is optional decoration that analysts add for readability
  2. Context such as targeting, timing, and environment determines whether and how an indicator should be used Correct answer.
  3. Context replaces the need for any technical indicator
  4. Context guarantees the indicator will never produce a false positive

Explanation

An indicator without context cannot be prioritised or safely applied, so details like targeting, timing, and environmental relevance determine its appropriate use. Context enriches decision-making but does not eliminate false positives or replace technical data.

Question 22Unverified content domain (source does not enumerate domains for this module)

An analyst must choose between two feeds: one with high volume and unverified indicators, and one with lower volume, corroborated indicators and documented sourcing. Which choice best reflects intelligence tradecraft?

  1. The high-volume feed, because more indicators always improve detection
  2. The high-volume feed, because unverified indicators are cheaper to process
  3. Neither feed, because external intelligence should never be used
  4. The corroborated feed, because verified sourcing and confidence improve analytic value per indicator Correct answer.

Explanation

Tradecraft favours intelligence whose sourcing and corroboration support confidence, since unverified volume increases noise and operational burden. Quality and verifiability matter more than raw indicator count when supporting defensive decisions.

Question 23Unverified content domain (source does not enumerate domains for this module)

A report asserts that a threat actor will likely target a sector within 30 days. Which combination of factors most strengthens this judgement?

  1. A high CVSS score on a widely used product
  2. Corroborated reporting on capability, intent, and opportunity, with explicit confidence and known gaps Correct answer.
  3. A single social media post and the analyst's intuition
  4. The actor's name appearing in a popular news article

Explanation

A defensible forecast rests on corroborated evidence of capability, intent, and opportunity, presented with explicit confidence and acknowledged gaps. Intuition, single-source anecdotes, popularity, or a severity score alone cannot support a specific targeting judgement.

Question 24Unverified content domain (source does not enumerate domains for this module)

Which scenario best illustrates the risk of over-relying on atomic indicators in detection engineering?

  1. Indicators become more reliable as they age
  2. Behavioural detections become unnecessary once hashes are deployed
  3. Detections fail when an adversary rotates a single IP address or hash while behaviour remains unchanged Correct answer.
  4. Detections improve because atomic indicators never change

Explanation

Atomic indicators such as single IPs and hashes are easily changed by adversaries, so detections built solely on them fail once infrastructure rotates. Behavioural detections that capture adversary techniques remain resilient when atomic artefacts change.

Question 25Unverified content domain (source does not enumerate domains for this module)

An analyst discovers that a widely shared indicator actually belongs to a legitimate cloud provider's shared infrastructure. What is the most appropriate analytic response?

  1. Continue blocking it because it appeared in a reputable feed
  2. Report the feed provider to law enforcement for fraud
  3. Suppress or downgrade the indicator and document the finding to prevent future false positives Correct answer.
  4. Delete all indicators from that provider permanently

Explanation

When an indicator maps to legitimate shared infrastructure, it should be suppressed or downgraded and the finding documented so future analyses avoid repeating the false positive. Continuing to block shared infrastructure risks disrupting legitimate services.

Question 26Unverified content domain (source does not enumerate domains for this module)

In a structured threat-intelligence platform, which element most directly records who produced an intelligence report and when it was published?

  1. The report's provenance metadata, such as author identity and publication timestamp Correct answer.
  2. The indicator pattern syntax used inside the report body
  3. The detection rule generated from the report
  4. The malware family name assigned to the report

Explanation

Provenance metadata captures the origin of a report, including who authored it and when it was released, which lets consumers judge freshness and trustworthiness. Indicator syntax, detection rules and family names describe content, not origin or timing.

Question 27Unverified content domain (source does not enumerate domains for this module)

An analyst is building a knowledge base of adversary behaviour and wants each entry to describe a repeatable pattern of activity rather than a single artefact. Which structured concept fits this need?

  1. A single file hash observed once on a workstation
  2. A TTP entry describing a technique the adversary repeatedly uses Correct answer.
  3. A raw packet capture from one incident
  4. A passive DNS record for one domain

Explanation

Tactics, techniques and procedures describe repeatable adversary behaviour and are far more durable than one-off artefacts. Hashes, packet captures and single DNS records are atomic observables tied to a specific moment.

Question 28Unverified content domain (source does not enumerate domains for this module)

A threat-intelligence team wants to record how confident it is in a judgement so consumers can weigh it appropriately. Which practice best supports this in a structured report?

  1. Publish the report without attribution so readers focus on content
  2. Attach an explicit confidence level and the reasoning behind the judgement Correct answer.
  3. Include only indicators that have been confirmed by two vendors
  4. Remove all speculative language to make the report read more decisively

Explanation

Structured confidence statements, paired with the rationale, let consumers calibrate how much weight to give a judgement. Stripping hedging or hiding attribution removes information rather than adding rigour.

Question 29Unverified content domain (source does not enumerate domains for this module)

Which statement best describes the purpose of an intelligence requirement in a SIDC programme?

  1. It specifies the file format used to exchange indicators
  2. It lists every indicator the organisation has ever collected
  3. It defines the specific question decision-makers need answered so collection and analysis can be focused Correct answer.
  4. It records the TLP marking applied to each report

Explanation

An intelligence requirement states the question that intelligence must answer, which directs collection and analysis toward decision-relevant work. Indicator inventories, exchange formats and marking schemes are operational details, not requirements.

Question 30Unverified content domain (source does not enumerate domains for this module)

An analyst needs to express a set of related observables and their relationships so another tool can consume them automatically. Which approach aligns with structured threat-intelligence practice?

  1. Store the observables in a spreadsheet with one sheet per analyst
  2. Publish the observables as a screenshot of the analysis console
  3. Encode the observables and relationships using a shared schema such as STIX Correct answer.
  4. Write a free-text email describing each observable in prose

Explanation

A shared schema such as STIX represents observables and their relationships in a machine-readable form that tools can parse and exchange. Prose, spreadsheets and screenshots require manual interpretation and break automation.

Question 31Unverified content domain (source does not enumerate domains for this module)

Which element of the intelligence cycle covers delivering finished intelligence to the consumers who need it?

  1. Collection
  2. Dissemination Correct answer.
  3. Processing
  4. Direction

Explanation

Dissemination is the phase in which finished intelligence is delivered to the consumers who requested or need it. Direction sets requirements, collection gathers raw data and processing converts it into usable form.

Question 32Unverified content domain (source does not enumerate domains for this module)

An analyst wants to describe the relationship between an observed malicious domain and the IP address it resolved to at a given time. Which structured representation is most appropriate?

  1. A malware family classification for the domain
  2. A free-text note in the case management system
  3. A single indicator with no links to other objects
  4. A relationship object connecting the domain and IP with a timestamp Correct answer.

Explanation

Relationship objects express how two observables are connected and can carry temporal context, preserving the analytical meaning of the link. A bare indicator, a text note or a family label does not encode the connection.

Question 33Unverified content domain (source does not enumerate domains for this module)

What does a TLP marking on a SIDC product primarily communicate to recipients?

  1. The malware family the report concerns
  2. The sharing boundaries the originator expects recipients to respect Correct answer.
  3. The confidence the analyst has in the assessment
  4. The technical severity of the threat described

Explanation

Traffic Light Protocol markings communicate the sharing boundaries and handling expectations set by the originator. Severity, confidence and family classification are separate analytic attributes.

Question 34Unverified content domain (source does not enumerate domains for this module)

A newly received indicator feed contains hashes, domains and IP addresses with no context. Which first step best supports turning these into actionable intelligence?

  1. Convert all indicators into YARA rules regardless of type
  2. Deploy every indicator to blocking controls immediately
  3. Enrich the indicators with context such as first-seen dates, infrastructure ownership and related campaigns Correct answer.
  4. Delete indicators older than a week without review

Explanation

Context such as age, ownership and campaign linkage determines whether an indicator is meaningful and how it should be used. Immediate blocking or blanket deletion without enrichment risks false positives or lost signal.

Question 35Unverified content domain (source does not enumerate domains for this module)

An analyst is assessing whether a reported indicator is likely to remain useful for detection over the coming months. Which characteristic most strongly suggests low durability?

  1. The indicator is a malware family name documented across several years
  2. The indicator is a vulnerability identifier tied to a widely deployed product
  3. The indicator is a domain registered days ago and used only by one short-lived campaign Correct answer.
  4. The indicator is a technique description drawn from multiple incidents

Explanation

Infrastructure that is newly registered and tied to a short-lived campaign is easily replaced, so it decays quickly as a detection artefact. Technique descriptions, vulnerability identifiers and family names persist because they describe durable concepts.

Question 36Unverified content domain (source does not enumerate domains for this module)

During an investigation an analyst finds that a suspicious IP address is a shared address used by a large cloud provider. What is the most appropriate analytic response?

  1. Report the cloud provider as a malicious actor
  2. Record the shared-hosting context and pivot to more specific observables such as domains or certificates Correct answer.
  3. Discard the IP and stop the investigation
  4. Treat the IP as a high-fidelity indicator and block it enterprise-wide

Explanation

Shared infrastructure produces false positives because many benign tenants use the same address, so the context must be recorded and analysis should pivot to more specific observables. Blocking or attributing the provider itself is disproportionate and inaccurate.

Question 37Unverified content domain (source does not enumerate domains for this module)

An analyst wants to reduce the chance that a single-source report is overstated in a finished SIDC product. Which action best reflects sound practice?

  1. Corroborate the claim with independent sources or clearly caveat it as single-source Correct answer.
  2. Remove the source attribution to protect the provider
  3. Increase the threat severity rating to compensate for uncertainty
  4. Present the single-source claim as established fact

Explanation

Single-source claims should be corroborated where possible or explicitly caveated so consumers understand the evidential basis. Presenting them as fact, hiding attribution or inflating severity all distort the assessment.

Question 38Unverified content domain (source does not enumerate domains for this module)

A detection engineer builds a rule that alerts on a single IP address previously associated with an intrusion. Six weeks later the rule generates many false positives. Which explanation best fits this outcome?

  1. The rule relied on an atomic indicator whose infrastructure was reassigned or reused Correct answer.
  2. The rule was deployed without a TLP marking
  3. The rule was written in the wrong query language
  4. The rule used too many behavioural conditions

Explanation

Atomic indicators such as single IP addresses are volatile and can be reassigned to benign tenants, producing false positives over time. Behavioural conditions, query syntax and TLP markings do not explain the drift.

Question 39Unverified content domain (source does not enumerate domains for this module)

An analyst is asked to judge the credibility of a claim that a named actor will target a specific sector. Which factor most strengthens the assessment?

  1. The claim appears in a report with a professional-looking layout
  2. The claim is supported by corroborating technical evidence and consistent with prior actor behaviour Correct answer.
  3. The claim was repeated by several news outlets citing the same original report
  4. The claim uses strong, confident language

Explanation

Credibility rests on corroborating technical evidence and consistency with established actor behaviour. Presentation quality, confident wording and circular repetition of one source do not independently strengthen a claim.

Question 40Unverified content domain (source does not enumerate domains for this module)

An organisation receives a SIDC product and wants to convert its findings into detection content. Which practice best aligns detection engineering with structured intelligence?

  1. Map behaviours described in the intelligence to detection logic and validate against the environment Correct answer.
  2. Prioritise indicators by alphabetical order of the feed
  3. Wait for the vendor to supply finished detection rules
  4. Copy every indicator verbatim into blocking rules without review

Explanation

Mapping described behaviours to detection logic, then validating in the local environment, produces durable and relevant detections. Verbatim blocking, waiting passively or arbitrary ordering ignores the analytic content of the intelligence.

Question 41Unverified content domain (source does not enumerate domains for this module)

An analyst must decide how to represent an adversary's use of a legitimate administration tool during an intrusion. Which structured approach best preserves analytic value?

  1. Omit the tool because it is legitimate software
  2. Record the tool as a vulnerability identifier
  3. Record the tool as a technique with the context of how it was abused Correct answer.
  4. Record the tool name as a malicious file hash

Explanation

Recording the abuse of a legitimate tool as a technique with context captures adversary behaviour without mislabelling benign software as malicious. Hashing, omitting or misclassifying the tool loses analytic meaning.

Question 42Unverified content domain (source does not enumerate domains for this module)

A SIDC team wants to ensure its finished products answer the questions stakeholders actually asked. Which practice best supports this?

  1. Structure reports around the stated intelligence requirements and decision points Correct answer.
  2. Publish only raw indicator lists without narrative
  3. Include every technical detail collected regardless of relevance
  4. Ask analysts to write reports in whatever format they prefer

Explanation

Aligning reports with stated requirements and decision points ensures the product is relevant and usable. Dumping all collected detail, omitting narrative or allowing arbitrary formats undermines that alignment.

Question 43Unverified content domain (source does not enumerate domains for this module)

An analyst notices that an indicator widely shared across community feeds actually belongs to a legitimate content delivery network. What is the most appropriate action?

  1. Remove the indicator from the feed silently without explanation
  2. Continue sharing it because other feeds include it
  3. Block the entire content delivery network
  4. Flag it as a false positive, document the finding and notify sharing partners Correct answer.

Explanation

Documenting the false positive and notifying partners improves community data quality and prevents repeated errors. Perpetuating the indicator, blocking a whole CDN or silently removing it without explanation causes harm or loses learning.

Question 44Unverified content domain (source does not enumerate domains for this module)

An analyst wants to compare two threat actors by the infrastructure they share. Which analytic approach best supports this comparison?

  1. List each actor's malware family names side by side
  2. Pivot on shared infrastructure observables and map the overlaps between the two sets Correct answer.
  3. Compare the publication dates of the reports describing each actor
  4. Rank the actors by the number of indicators attributed to each

Explanation

Pivoting on shared observables and mapping overlaps reveals genuine infrastructure connections between actors. Family names, publication dates and indicator counts do not demonstrate shared infrastructure.

Question 45Unverified content domain (source does not enumerate domains for this module)

A manager asks why the team should not simply block every indicator received from a commercial feed. Which argument best reflects SIDC practice?

  1. Commercial feeds never contain useful data
  2. Blocking indicators has no effect on adversary operations
  3. Unvetted indicators include false positives and shared infrastructure that can disrupt legitimate business activity Correct answer.
  4. Indicators always expire within 24 hours

Explanation

Unvetted indicators carry false positives and shared infrastructure, so blanket blocking risks business disruption. Indicators do not universally expire in a day, blocking does affect operations when accurate, and commercial feeds can be valuable when validated.

Question 46Unverified content domain (source does not enumerate domains for this module)

An analyst is drafting a judgement about an adversary's likely next target and wants to reduce the influence of anchoring on an early hypothesis. Which technique is most appropriate?

  1. Rely on the most recent report received
  2. Delay the assessment until the adversary acts
  3. Gather more evidence that supports the original hypothesis
  4. Seek disconfirming evidence and consider alternative hypotheses explicitly Correct answer.

Explanation

Actively seeking disconfirming evidence and weighing alternative hypotheses counters anchoring and confirmation bias. Seeking supporting evidence reinforces the anchor, delay avoids the judgement and recency bias substitutes one distortion for another.

Question 47Unverified content domain (source does not enumerate domains for this module)

A finished SIDC report states that an actor will likely exploit a newly disclosed vulnerability within two weeks. Which combination of factors most strengthens this judgement?

  1. The report was requested by senior leadership
  2. The vulnerability is severe and the actor is well known
  3. The vulnerability affects a widely used product
  4. The actor has a documented history of rapid exploitation and there is evidence of active scanning for the vulnerability Correct answer.

Explanation

Prior behaviour of rapid exploitation plus observed active scanning provides specific, corroborating evidence for the timing judgement. Severity, seniority of the requester and product popularity are background factors that do not demonstrate intent or capability.

Question 48Unverified content domain (source does not enumerate domains for this module)

An analyst finds that a campaign report's indicators cluster around a single hosting provider and a narrow time window. What is the most defensible inference?

  1. The actor will permanently avoid other hosting providers
  2. All customers of that provider are compromised
  3. The campaign has ended and no further monitoring is needed
  4. The indicators are likely time-bound and provider-specific, so detections should emphasise behaviour Correct answer.

Explanation

Clustering in one provider and a narrow window suggests the artefacts are transient, so durable detections should focus on behaviour. Permanent avoidance, assuming the campaign has ended or condemning all tenants are unsupported leaps.

Question 49Unverified content domain (source does not enumerate domains for this module)

A team is deciding whether to share a SIDC product with a partner under a restrictive marking. Which consideration is most important before sharing?

  1. Whether the partner's tooling can parse the file format
  2. Whether the partner has a larger analyst team
  3. Whether the originator's handling conditions permit sharing with that partner Correct answer.
  4. Whether the product contains more than a hundred indicators

Explanation

Handling conditions set by the originator determine whether and how a product may be shared; violating them damages trust and may breach agreements. Format compatibility, team size and indicator volume are secondary operational factors.

Question 50Unverified content domain (source does not enumerate domains for this module)

An analyst is asked to evaluate whether a newly published technique description should change the team's detection priorities. Which reasoning best reflects structured intelligence practice?

  1. Assess whether the technique applies to the organisation's technology stack and whether the actor using it is relevant Correct answer.
  2. Adopt it immediately because it is newly published
  3. Defer the decision until the technique appears in a commercial feed
  4. Reject it because it has not yet appeared in the organisation's logs

Explanation

Relevance depends on applicability to the local environment and on whether a relevant actor uses the technique. Novelty alone, absence from logs so far or waiting for a commercial feed are weak decision criteria.