312-85: Certified Threat Intelligence AnalystDemo

Tyrion, a professional hacker, is targeting an organization to steal confidential information. He wants to conduct website footprinting to obtain the following information, which is concealed in the web page header:

• Connection status and content type
• Accept-ranges and last-modified information
• X-powered-by information
• The web server being used and its version

Which of the following tools should Tyrion use to view the header content?

Mario works as an analyst for an XYZ organization in the United States. He has been asked to prepare a threat landscape report that provides in-depth awareness and greater insight into the threats facing his organization.

Which of the following details should she include when preparing a threat landscape report?

Alison, an analyst at an XYZ organization, wants to retrieve information about a company’s website from its inception, including information that has been removed from the target website.

What should Alison do to obtain the information needed?

Walter and Sons Company has experienced major cyberattacks and the loss of confidential data. The company has decided to focus more on security than on other resources. Therefore, it hired Alice, a threat analyst, to perform data analysis. Alice was asked to conduct qualitative data analysis to extract useful information from collected bulk data.

Which of the following techniques would help Alice perform qualitative data analysis?

ABC is a well-established cybersecurity company in the United States. The organization has automated tasks such as data enrichment and indicator aggregation. It has also joined various communities to expand its knowledge of emerging threats. However, the security teams can detect and prevent only identified threats through a reactive approach.

Based on the threat intelligence maturity model, identify ABC's level to determine the stage at which the organization stands regarding its security and vulnerabilities.

Which of the following attacks involves an attacker exploiting vulnerabilities in a computer application before the software developer is able to release a patch?

Jian is a member of the security team at Trinity, Inc. He is conducting a real-time assessment of system activities to acquire threat intelligence feeds. He obtains feeds from sources such as honeynets, P2P monitoring infrastructure, and application logs.

Which category of threat intelligence feed did Jian acquire?

A team of threat-intelligence analysts is conducting malware threat analysis, and each analyst has developed a theory and evidence supporting that theory for a particular malware sample.

To identify the theory that is most consistent among all the theories, which analytic process must the threat intelligence manager use?

Which type of threat attribution involves identifying the specific person, society, or country that sponsors a carefully planned and executed intrusion or attack against its target?

During threat intelligence analysis, John, a threat analyst, successfully extracted information about an adversary, such as its modus operandi, tools, communication channels, and forensic-evasion strategies.

Identify the type of threat intelligence analysis John performed.

Kira is a security analyst in an organization. She has been asked to define and establish requirements before collecting threat intelligence information. The requirements should concentrate on what must be gathered to fulfill production intelligence.

Which category of threat intelligence requirements should Kira focus on?

Jacob, a professional hacker, made an exact copy of an online shopping website. He copied all content from the original site to a local system, enabling him to build a dummy spam website for social-engineering attacks against employees.

Which technique did Jacob use to clone the website?

Kathy wants to ensure she shares threat intelligence containing sensitive information with the appropriate audience. Therefore, she used the Traffic Light Protocol (TLP).

Which TLP color indicates that information should be shared only within a particular community?

You are a cybersecurity analyst at a financial institution. An unusual pattern of financial transactions has been detected, indicating possible fraud or money laundering. What specific type of threat intelligence would you use to analyze these financial activities and identify potential risks?

Within a team of threat analysts, two people competed to project their respective hypotheses about given malware. To identify logical proof supporting those hypotheses, the threat intelligence manager applied a de-biasing strategy involving the study of strategic decision-making in situations with multistep interactions among numerous representatives, with or without perfect relevant information.

Which de-biasing strategy did the threat intelligence manager use to validate their hypotheses?

John, a threat intelligence analyst at Cybertech Company, was asked to obtain information that gives greater insight into the current cyber risks. To gather this information, John needs to answer the following questions:

• Why might the organization be attacked?
• How might the organization be attacked?
• Who might the intruders be?

Identify the type of security testing John is going to perform.

Alice, an analyst, shared information with security operations managers and network operations center (NOC) staff to protect organizational resources from various threats. The information Alice shared was highly technical and included threat-actor TTPs, malware campaigns, tools used by threat actors, and so on.

Which type of threat intelligence did Alice share?

Which sequence of steps is correct for scheduling a threat intelligence program?

1. Review the project charter
2. Identify all deliverables
3. Identify the sequence of activities
4. Identify task dependencies
5. Develop the final schedule
6. Estimate the duration of each activity
7. Identify and estimate resources for all activities
8. Define all activities
9. Build a work breakdown structure (WBS)

Enrage Tech Company hired Enrique, a security analyst, to perform threat-intelligence analysis. During the data-collection process, he used a counterintelligence mechanism in which a recursive DNS server performs interserver DNS communication. When any name server generates a request to the recursive DNS server, the recursive DNS servers log the received responses. The logged data is then replicated and stored in a central database. Using these logs, he analyzed malicious attempts occurring across the DNS infrastructure.

Which cyber counterintelligence (CCI) gathering technique did Enrique use for data collection?

An attacker directs bots to use a camouflage mechanism that conceals phishing and malware-delivery locations within a rapidly changing network of compromised bots. In this technique, one domain name is associated with multiple IP addresses.

Which technique does the attacker use?

SecurityTech Inc. is developing a TI plan to achieve more benefits with less funding. While selecting a TI platform, it wants to include a feature that ranks elements such as intelligence sources, threat actors, attacks, and the organization’s digital assets, so it can allocate more funds to resources that are critical to the organization’s security.

Which of the following key features should SecurityTech Inc. consider in its TI plan when selecting the TI platform?

Karry, a threat analyst at an XYZ organization, is conducting threat intelligence analysis. During the data-collection phase, he used a collection method involving no participants and based solely on analyzing and observing activities and processes occurring within the organization’s local boundaries.

Identify the type of data collection method Karry used.

James, a senior threat intelligence officer, was assigned to assess the success and failure of the organization’s established threat intelligence program. As part of this assessment, James reviewed the intelligence program’s outcomes, determined whether the program required any improvements, and identified past learnings that could be applied to future programs.

Identify the activity James performed in this scenario.

A consortium was formed through a collaborative effort to improve the cybersecurity posture of several organizations in an industry sector. The participating organizations chose a threat-intelligence exchange architecture in which all threat data is gathered, analyzed, and distributed through one central hub. What type of threat-intelligence exchange architecture was implemented in this scenario?