1 - 3: Threat Intelligence

Question 1

Threat Intelligence

Answer 1

Actions taken to educate about changes in cybersecurity, adapting security controls based on that knowledge

Question 2

Open-source Intelligence

Answer 2

Uses public information, often using security websites, vulnerability databases, dark web sources, sharing centers, file or code repositories, or security researchers

Question 3

Email address harvesting

Answer 3

Searches for valid addresses for social engineering attacks

Question 4

Criteria for threat intelligence source

Answer 4

Timeliness, accuracy, reliability

Question 5

Threat indicators

Answer 5

Data or other information that describes a threat, such as IP addresses or file signatures

Question 6

CybOX (not questioned on exam)

Answer 6

Cyber Observable eXpression, a standardized schema for categorizing security observations, including intrusion attempts and malicious software

Question 7

STIX

Answer 7

Structured Threat Information eXpression, a standardized language communicating security information between systems, using CybOX

Question 8

TAXII

Answer 8

Trusted Automated eXachange of Indicator Information, provides a technical framework for exchanging messages and information written in the STIX language

Question 9

OpenIOC

Answer 9

Mandiant Labs’s threat intelligence language, describes file names, sizes, and specific indicators

Question 10

Functions threat intelligence supports

Answer 10

Incident response, vulnerability management, risk management, security engineering, detection and monitoring / SOCs

Question 11

ISACs

Answer 11

Information Sharing and Analysis Centers, confidential sharing centers for threat intelligence based on industry

Question 12

Threat research

Answer 12

Understanding adversaries’ methods, intent, etc

Question 13

Threat research techniques

Answer 13

Reputational threat research and Behavioral threat research

Question 14

Reputational threat research

Answer 14

Identifying potentially malicious actors based on previous behavior, IP addresses, email, domains

Question 15

Behavioral threat research

Answer 15

Identifying potentially malicious actors based on the similarity of behaviors to past attackers

Question 16

Research sources

Answer 16

Vendor websites, vulnerability feeds, conferences, academic journals, request for comment documents, threat feeds, TTP publications

Question 17

Threat identification

Answer 17

A structured approach to assessing possible threats, typically as asset focused, threat focused, or service focused

Question 18

Asset focused approach

Answer 18

An analysis based on the organizations asset inventory

Question 19

Threat focused approach

Answer 19

Identifying how specific threats could affect each information system, chiefly to understand an adversary’s capability

Question 20

Service focused approach

Answer 20

Identify the impact to services hosted over the internet and related interfaces

Question 21

Automating threat intelligence

Answer 21

Providing responses to threat indications automatically when certain criteria are met, such as blocking IPs or certain network traffic

Question 22

Minimizing disruption from automation

Answer 22

Test automated services in alert-only mode

Question 23

Automating threat feeds

Answer 23

Combining threat feeds into a single, more refined information source

Question 24

Data enrichment

Answer 24

Automation to assist incident response by providing assistance with routine details, including source reconnaissance, retrieving related logs, or triggering a vulnerability scan

Question 25

SOAR

Answer 25

Security Orchestration, Automation, and Response that automate and enhance SIEM capabilities

Question 26

Machine learning for threats

Answer 26

Can scan and assist in creating a signature definition for threats and malware

Question 27

Assumption of Compromise

Answer 27

Considering attackers have already made a foothold in approaching security risks

Question 28

Threat hunting

Answer 28

An organized, systematic approach to seeking indicators of compromise using expertise and analytic techniques

Question 29

First step in threat hunting

Answer 29

Establish a hypothesis, thinking like an attacker would based on available information

Question 30

Indicators of Compromise

Answer 30

Unusual binary files, unexpected processes or resource consumption, deviations in network traffic, alterations in permissions, unexplained log entries, unapproved config changes