Day 2 Quiz - Exploring Threat Intelligence & Threat Hunting ....

Objective 1.4/Day 2 -

A security analyst is evaluating the motivations and resources behind a prolonged and sophisticated attack on the organization’s network. The attack seems to be well-funded, persistent, and targeted specifically at stealing sensitive data. Which type of threat actor is most likely behind this attack?

• Script kiddie

• Insider threat

• Organized crime

• Advanced persistent threat (APT)

Answer explanation

The characteristics described in the scenario—prolonged, sophisticated, well-funded, and targeted—are indicative of an Advanced Persistent Threat (APT). APTs are typically associated with nation-states or other highly organized entities that have significant resources and motivation to achieve specific objectives, often involving stealing sensitive data over an extended period. Script kiddies lack the sophistication and resources, while insider threats may not have the same level of persistence or targeting. Organized crime can be sophisticated, but their primary motivation is usually financial gain, and they may not exhibit the same persistence or specific targeting as APTs.

Tags

Objective 1.4

Objective 1.4/Day 2 -

An organization is concerned about employees unintentionally exposing sensitive information through phishing attacks. Which type of insider threat does this scenario best describe?

• Unintentional insider threat

• Intentional insider threat

• Script kiddie

• Hacktivist

Answer explanation

The scenario describes employees who might unintentionally expose sensitive information, which aligns with the concept of an Unintentional insider threat. These are individuals within the organization who do not intend to cause harm but may do so accidentally, often through actions like falling victim to phishing attacks. An Intentional insider threat would involve someone deliberately acting against the organization's interests. Script kiddies and hacktivists are external threats rather than insiders.

Tags

Objective 1.4

Objective 1.4/Day 2 -

Which threat actor is most likely to engage in politically motivated attacks, often seeking to disrupt services or deface websites to spread a particular message?

• Advanced persistent threat (APT)

• Nation-state

• Hacktivist

• Supply chain attacker

Answer explanation

Hacktivists are threat actors who engage in politically or socially motivated attacks. They often aim to disrupt services, deface websites, or spread a particular message related to their cause. APTs and nation-states may also engage in sophisticated attacks, but their motivations are usually more focused on espionage, data theft, or national security. A supply chain attacker targets vulnerabilities within the supply chain, typically for financial gain or espionage, rather than spreading a message.

Tags

Objective 1.4

Objective 1.4/Day 2 -

A security analyst receives a threat intelligence report that contains data about a new malware variant. The report was published six months ago, and the malware's characteristics have likely evolved since then. Which confidence level aspect is most impacted by the age of the report?

• Relevancy

• Timeliness

• Accuracy

• Collection method

Answer explanation

The timeliness of threat intelligence refers to how current the information is. In this scenario, the six-month-old report may no longer be timely, as the malware's characteristics could have changed. This impacts the usefulness of the information in making informed security decisions. While relevancy and accuracy are also important, the primary concern here is the information's timeliness, as outdated intelligence may not accurately reflect current threats. Collection method relates to how the data was gathered, not its timeliness.

Tags

Objective 1.4

Objective 1.4/Day 2 -

Which of the following is an example of a closed-source threat intelligence collection method?

• Government bulletins

• Paid feeds

• Social media

• Deep/dark web

Answer explanation

Paid feeds are an example of a closed-source threat intelligence collection method, where organizations pay for access to curated and proprietary threat intelligence data. This contrasts with open-source methods like government bulletins, social media, and deep/dark web monitoring, where information is publicly accessible or gathered from open sources.

Tags

Objective 1.4

Objective 1.4/Day 2 -

During threat hunting, an analyst is reviewing information from forums and blogs to identify potential indicators of compromise (IOCs) related to a recent vulnerability. Which collection method is the analyst primarily using?

• Closed source

• Government bulletins

• Open source

• Internal sources

Answer explanation

The analyst is using open source collection methods, which include gathering information from publicly accessible platforms like forums and blogs. These sources provide valuable insights into emerging threats and indicators of compromise (IOCs). Closed source refers to paid or proprietary data, while government bulletins are a specific type of open-source intelligence, and internal sources are data generated within the organization.

Tags

Objective 1.4

Objective 1.4/Day 2 -

An organization is implementing a threat intelligence sharing program to improve its security posture. How can sharing threat intelligence specifically enhance the organization's incident response capabilities?

• By reducing the need for vulnerability assessments

• By providing timely information on emerging threats

• By eliminating the need for security engineering efforts

• By ensuring compliance with legal and regulatory requirements

Answer explanation

Sharing threat intelligence can significantly enhance an organization's incident response capabilities by providing timely information on emerging threats. This allows the incident response team to proactively identify and mitigate potential threats before they can impact the organization. While vulnerability assessments and security engineering are also important, the primary benefit here is the timely and relevant information that aids in responding to incidents quickly and effectively. Compliance with legal and regulatory requirements is a broader consideration and not directly tied to the specific enhancement of incident response through threat intelligence sharing.

Tags

Objective 1.4

Objective 1.4/Day 2 -

A security team is using shared threat intelligence to prioritize patching efforts based on the most critical vulnerabilities affecting the organization. Which aspect of threat intelligence sharing does this activity best align with?

• Risk management

• Detection and monitoring

• Security engineering

• Vulnerability management

Answer explanation

Using shared threat intelligence to prioritize patching efforts aligns with vulnerability management. The shared intelligence helps the security team identify which vulnerabilities are most critical and should be addressed first, ensuring that resources are allocated effectively to reduce the organization's risk. Risk management is more about identifying and mitigating risks overall, while detection and monitoring involve ongoing surveillance for threats, and security engineering focuses on building and maintaining secure systems.

Tags

Objective 1.4

Objective 1.4/Day 2 -

During a threat-hunting exercise, a security analyst discovers unusual outbound traffic patterns from an isolated network. What is the primary focus area the analyst is addressing in this scenario?

• Business-critical assets and processes

• Configurations/misconfigurations

• Honeypot

• Isolated networks

Answer explanation

The primary focus area being addressed is isolated networks, as the analyst is monitoring an isolated network for unusual activity, which could indicate a breach or compromise. Business-critical assets and processes refer to the most vital parts of the organization that require protection, configurations/misconfigurations involve checking system settings for security issues, and a honeypot is a decoy system used to attract attackers, which is not applicable in this scenario.

Tags

Objective 1.4

Objective 1.4/Day 2 -

A threat hunter is analyzing collected Indicators of Compromise (IoCs) to determine the presence of specific threats within the organization's environment. Which of the following best describes the process the threat hunter is engaged in?

• IoC Application

• IoC Collection

• IoC Analysis

• Active defense

Answer explanation

The threat hunter is engaged in IoC Analysis, where they are examining collected Indicators of Compromise to identify potential threats within the organization's environment. IoC Application involves using IoCs to detect and respond to threats, IoC Collection is the gathering of IoCs from various sources, and active defense refers to proactive measures taken to detect and respond to threats, but is broader than just analyzing IoCs.

Tags

Objective 1.4