CySA+ Study Guide Book: Threat Intelligence

Which of the following measures is not commonly used to assess threat intelligence?

• 1. Timeliness

• 1. Detail

• 1. Accuracy

• 1. Relevance

Answer explanation

"Detail" is not commonly used as a specific measure to assess threat intelligence. The other options—Timeliness, Accuracy, and Relevance—are critical factors in evaluating the quality and usefulness of threat intelligence. Timeliness refers to how current the information is, Accuracy indicates the correctness of the data, and Relevance assesses how applicable the intelligence is to the specific context or environment. While the level of detail can be important, it is not a standard measure like the others.

Nandita has encountered an attacker who appears to be using a commonly available exploit package to attack her organization. The package seems to have been run with default configurations against her entire public-facing Internet presence from a single system. What type of threat actor is she most likely facing?

• 1. An APT

• 1. A hacktivist

• 1. A script kiddie

• 1. A nation-state actor

Answer explanation

Nandita is most likely facing a script kiddie. This type of threat actor typically uses readily available exploit packages and tools without a deep understanding of how they work, often running them with default configurations. The fact that the attack is against her organization's public-facing Internet presence from a single system indicates a less sophisticated approach, which aligns with the behavior of script kiddies. Advanced Persistent Threats (APTs) and nation-state actors usually employ more targeted and sophisticated methods, while hacktivists are motivated by political or social causes rather than opportunistic exploitation.

Which of the following activities follows threat data analysis in the threat intelligence cycle?

• 1. Gathering feedback

• 1. Threat data collection

• 1. Threat data review

• 1. Threat intelligence dissemination

Answer explanation

Following threat data analysis in the threat intelligence cycle, the next activity is threat intelligence dissemination. This step involves sharing the analyzed threat intelligence with relevant stakeholders to inform them of potential threats and improve security measures. Gathering feedback typically occurs after dissemination to assess the utility of the intelligence shared, while threat data collection and threat data review are earlier stages in the cycle that precede analysis.

Susan wants to start performing intelligence gathering. Which of the following options is frequently conducted in the requirements gathering stage?

• 1. Review of security breaches or compromises your organization has faced

• 1. Review of current vulnerability scans

• 1. Review of current data handling standards

• 1. Review of threat intelligence feeds for new threats

Answer explanation

In the requirements gathering stage of intelligence gathering, reviewing security breaches or compromises that the organization has previously faced is a crucial activity. This review helps identify vulnerabilities and areas needing improvement, informing the focus of future intelligence efforts. The other options—reviewing current vulnerability scans, current data handling standards, and threat intelligence feeds—are important but are typically addressed in later stages of the intelligence gathering process, such as analysis or operational planning.

What organizations did the U.S. government help create to help share knowledge between organizations in specific verticals?

• 1. DHS

• 1. SANS

• 1. CERTs

• 1. ISACs

Answer explanation

The U.S. government helped create Information Sharing and Analysis Centers (ISACs) to facilitate knowledge sharing between organizations in specific verticals, such as finance, energy, and healthcare. ISACs provide a platform for members to share information about threats, vulnerabilities, and best practices. While the Department of Homeland Security (DHS) plays a role in cybersecurity efforts, and organizations like SANS and CERTs (Computer Emergency Response Teams) contribute to cybersecurity education and incident response, ISACs are specifically focused on collaboration within particular sectors.

Which of the following threat actors typically has the greatest access to resources?

• 1. Nation-state actors

• 1. Organized crime

• 1. Hacktivists

• 1. Insider threats

Answer explanation

Nation-state actors typically have the greatest access to resources among the listed threat actors. They often have substantial funding, advanced technology, and highly skilled personnel, allowing them to conduct sophisticated cyber operations. Organized crime can also be well-resourced but generally lacks the same level of access and support as nation-states. Hacktivists usually operate with limited resources driven by ideological motives, while insider threats may have access to organizational resources but do not possess the broad capabilities of nation-state actors.

Organizations like Anonymous, which target governments and businesses for political reasons, are examples of what type of threat actor?

• 1. Hacktivists

• 1. Military assets

• 1. Nation-state actors

• 1. Organized crime

Answer explanation

Organizations like Anonymous are examples of hacktivists. Hacktivists engage in cyber activities motivated by political or social causes, often targeting governments and businesses to promote their agenda. They typically operate as loosely organized groups and use various online tactics to raise awareness or protest against perceived injustices. Military assets refer to state-sponsored operations, while nation-state actors engage in more comprehensive and strategic cyber operations for national interests. Organized crime focuses primarily on financial gain rather than political motives.

Jason gathers threat intelligence that tells him that an adversary his organization considers a threat likes to use USB key drops to compromise their targets. What is this an example of?

• 1. His organization's attack surface

• 1. A possible attack vector

• 1. An example of adversary capability

• 1. A probability assessment

Answer explanation

The information that an adversary uses USB key drops to compromise targets is an example of a possible attack vector. Attack vectors are the paths or methods that attackers use to gain access to a system or network. In this case, USB key drops represent a physical means of delivering malware or exploiting vulnerabilities. While the organization's attack surface refers to all potential points of exposure, and adversary capability relates to the skills and resources of the attacker, the specific use of USB keys to compromise targets clearly defines an attack vector. A probability assessment, on the other hand, involves evaluating the likelihood of specific threats occurring.

What type of assessment is particularly useful for identifying insider threats?

• 1. Behavioral

• 1. Instinctual

• 1. Habitual

• 1. IOCs

Answer explanation

A behavioral assessment is particularly useful for identifying insider threats. This type of assessment focuses on monitoring and analyzing patterns of behavior among employees to detect any unusual or suspicious activities that may indicate malicious intent or risk. Behavioral assessments can help organizations identify anomalies in actions, such as unauthorized access to sensitive information or changes in work habits. Instinctual and habitual assessments are less formalized approaches, while IOCs (Indicators of Compromise) typically relate to external threats rather than specifically targeting insider threats.

Felix want to gather threat intelligence about an organized crime threat actor. Where is he most likely to find information published by the threat actor?

• 1. Social media

• 1. Blogs

• 1. Government bulletins

• 1. The dark web

Answer explanation

Felix is most likely to find information published by an organized crime threat actor on the dark web. The dark web is often used by criminal organizations to communicate, share information, and conduct illicit activities while remaining anonymous. Although social media and blogs may contain some relevant information, they are less likely to host direct communications or publications from organized crime groups. Government bulletins typically focus on broader threat assessments and do not usually include direct insights from criminal actors.