CA1-005: CompTIA SecurityXDemo

Question

While carrying out threat-hunting functions, an analyst uses the Diamond Model of Intrusion Analysis. The analyst identifies the likely adversary, the infrastructure involved, and the target. Which of the following must the threat hunter document to use the model effectively?

A Knowledge
B Capabilities
C Phase
D Methodologies

Explanation

The Diamond Model represents an intrusion event through four core features: adversary, infrastructure, capability, and victim. Capability captures the tools, techniques, or other means the adversary uses; it completes the model when the adversary, infrastructure, and target (victim) are already known.

Learn more

The Diamond Model

CA1-005: CompTIA SecurityXDemo

AstroTutor

Notes

Readiness

QuestionQ15

Community Discussion