Domain 1 - Threat Actors, Vectors, and Intelligence Sources

A company discovers that an unauthorized access attempt was made on its internal network, and the attacker had sophisticated tools and extensive knowledge of the organization's infrastructure. What attribute of threat actors is most likely evident in this scenario?

• Low sophistication

• External threat

• High capability

• Unmotivated intent

An individual hacks into a computer system to expose political corruption and advocate for social change. What category of threat actor does this person fall into?

• Script kiddie

• Black hat hacker

• Hacktivist

• Criminal syndicate

An attacker gains access to a corporate network by exploiting vulnerabilities in third-party software used by the organization. What vector is utilized in this scenario?

• Direct access

• Supply chain

• Wireless

• E-mail

An organization notices suspicious activities on its network originating from an external source. The attack vector involves manipulating human behavior through deceptive messages. What vector is most likely employed?

• Cloud

• Removable media

• Social media

• E-mail

A cybersecurity analyst gathers information about potential threats by monitoring discussions on underground forums and analyzing publicly available data. What type of threat intelligence source is being utilized?

• Predictive analysis

• Dark web

• Automated Indicator Sharing

• Open source intelligence

An organization subscribes to a service that automatically shares threat indicators with other trusted entities in real-time. What threat intelligence sharing method is being employed?

• Automated Indicator Sharing

• Structured Threat Information Expression

• Threat maps

• Vulnerability databases

A security analyst is studying an academic journal to stay informed about the latest vulnerabilities and attack techniques. What type of research source is being utilized?

• Threat feeds

• Conferences

• Academic journals

• Vendor websites

A company wants to understand the tactics, techniques, and procedures (TTPs) employed by potential adversaries. Which research source would be most helpful for this purpose?

• Local industry groups

• Social media

• Adversaries' TTPs

• Threat feeds

A security researcher attends an international cybersecurity conference to learn about the latest trends and developments in the field. What type of research source is being utilized?

• Threat feeds

• Conferences

• Vendor websites

• Requests for comment

An organization monitors industry-specific forums and online communities to gather information about potential threats targeting their sector. What type of research source is being utilized?

• Threat maps

• Social media

• Local industry groups

• Threat intelligence feeds