Cti Quiz

What is the role of a Collection Management Framework (CMF)?

• To store all collected threat data securely

• To plan how data is collected, from where, and what type

• To manage the budget for the CTI team

• To train new analysts in threat detection

Which of the following best describes Priority Intelligence Requirements (PIRs)?

• Optional requirements

• Mission-critical requirements

• Software-generated requirements

• External threat requirements

What should be done when executives request attribution on a specific threat group without first-hand data?

• Provide a generic report

• Outsource the analysis

• Clarify that the requirement cannot be confidently satisfied

• Ignore the request

During a recent financial breach investigation, you discover malware behavior similar to the Carbanak group. Which of the following scenarios is MOST likely based on this group's tactics?

• Unauthorized SWIFT transfers to offshore accounts

• ATM machines dispensing cash at predetermined times

• Modification of database records to inflate account balances

• Encryption of financial records for ransom

Which of the following statements best describes the significance of Industroyer (also known as Crashoverride) malware in the context of cyber threats to critical infrastructure?

• It was the first malware to specifically target smart home devices, highlighting vulnerabilities in IoT infrastructure.

• It was the first known malware designed to disrupt electric grid operations, capable of causing power outages by attacking multiple industrial control protocols.

• It was primarily a data exfiltration tool, focusing on stealing sensitive information from power companies without causing operational disruptions.

• It was a cryptocurrency mining malware that specifically targeted the computing infrastructure of power plants, affecting their operational efficiency.

Your team needs to gather intelligence on a new threat actor targeting your industry. Which approach within the External Collection Management Framework would be MOST effective for prioritizing your collection efforts?

• Focusing solely on technical indicators from previous attacks

• Aligning collection requirements with your organization's strategic objectives

• Maximizing the volume of data collected from all available sources

• Relying primarily on open-source intelligence (OSINT) to reduce costs

You're investigating a sophisticated supply chain attack. Using the Target-Centric Intelligence Analysis model, what should be your FIRST step?

• Identify all potential adversaries capable of such an attack

• Define the specific target of interest within the supply chain

• Collect all available data related to supply chain attacks

• Assess the impact on your organization's operations

In system-level analysis for detecting malware installation, which of the following is NOT typically considered a strong indicator of malicious activity when found in Internet Explorer's temporary files?

•  Invisible iframes with dimensions of 0x0 or 100x0 

• Flash files in conjunction with other suspicious indicators 

• Standard-sized iframes with normal content 

• Files with MAC times aligning closely to known Stage 5 indicators

In the context of cyber threat intelligence, which of the following is NOT considered a primary source for obtaining malware samples?

• First Party Data 

• Partners 

• Open Source Repositories 

• Commercial datasets

Which of the following is considered one of the basic, most pivotable indicator types in cyber threat intelligence, and is often associated with compromised systems, actor registrations, or Dynamic DNS?

• IP addresses

• Domains

• Unique Strings

• Encryption keys