uC 003 Threat Intelligence

What organizations did the U.S. government create to help share knowledge between organizations in specific verticals?

• ISACs

• CERTs

• SANS

• DHS

Nick wants to analyze attacker tactics and techniques. What tool can he deploy to capture actual attack data for analysis most effectively?

• A honeypot

• A web application firewall

• A SIEM

• A firewall

Which of the following is not a common focus area for threat hunting activities?

• Policies

• Misconfigurations

• Isolated networks

• Business-critical assets

Felix wants to gather threat intelligence about an organized crime threat actor. Where is the most likely to find information published by the threat actor?

• Government bulletins

• The dark web

• Social media

• Blogs

_________ threats are threats from employees or other trusted individuals or groups within an organization.

• Insider

• Instinctual

• Habitual

• Outsider

Which of the following threats are nation-state-sponsored organizations with significant resources and capabilities and provide the highest level of threat on the adversary tier list?

• Hacktivists

• Script kiddies

• APTs

• Organized crimes

Advanced persistent threats are most commonly associated with which type of threat actor?

• Organized crime

• Nation-state actors

• Insider threats

• Hacktivists

Which of the following is not a common indicator of compromise (IOC)?

• Login activity from atypical countries or locations

• Large outbound data transfers from administrative systems

• Administrative account logins

• Unexpected modifications of configuration files

The United States has threat intelligence sharing centers for major areas like healthcare, aviation, and finance. What are these centers called?

• ISAC

• SLA

• RAD

• IoT

Answer explanation

In the United States, threat intelligence sharing centers are called Information Sharing and Analysis Centers (ISACs). ISACs help infrastructure owners and operators to share threat information as well as provide tools and assistance to their members. ISACs operate on a trust model, allowing in-depth sharing of threat information for both physical and cyber threats. Most ISACs operate 24/7, providing ISAC members in their sector with incident response and threat analysis.

Malena works as a cybersecurity analyst in an XYZ company. Her company assigned her to investigate threats using the threat intelligence cycle. Using this process, she started her work by assessing what kinds of security breaches or compromises her company has faced, and according to intelligence requirements, she started collecting data from threat intelligence sources. What should be Malena's next step in the given scenario?

• Feedback

• Data processing and analysis

• Data collection

• Intelligence dissemination