Threat Prediction with Cyber Threat Intelligence CND Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst receives a threat intelligence report containing a list of file hashes, domain names, and IP addresses associated with a new ransomware campaign. The analyst wants to detect potential infections in the environment. Which integration would allow the most comprehensive detection using these IoCs?

   • AUpload the hashes to VirusTotal and wait for the results to be shared back.
   • BImport the hashes into the EDR and the domains/IPs into the SIEM as watchlists.
   • CAdd the domains to the DNS sinkhole and block the IPs at the firewall.
   • DManually check each endpoint for the file hashes using a script.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst has identified a new malware variant in the environment. The analyst has extracted a file hash, a command-and-control domain, and a unique registry key. The team wants to detect other infected hosts. Which approach would be most effective?

   • AManually check each endpoint for the registry key.
   • BSearch only for the file hash in the SIEM logs.
   • CBlock the domain at the firewall and assume the infection is contained.
   • DSearch the SIEM for the domain and registry key, and use the EDR to hunt for the file hash across all endpoints.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A threat intelligence team has completed the collection and analysis phases and has produced a report on a new attack campaign. What is the next step in the threat intelligence lifecycle?

   • ACollect more data to verify the findings
   • BDisseminate the intelligence to relevant stakeholders
   • CDiscard the report if the campaign is not directly targeting the organization
   • DIntegrate the raw data into the SIEM
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security director wants to justify the budget for a threat intelligence program. The board asks for evidence that threat intelligence can reduce risk. The director has access to historical incident data and a commercial feed. What is the best way to demonstrate the value of threat intelligence?

   • AShow the number of alerts generated by the SIEM after integrating the feed.
   • BPresent a list of all the IoCs the feed has identified in the past month.
   • CExplain the technical details of the intelligence lifecycle to the board.
   • DCorrelate past incidents with intelligence feeds to show how many could have been prevented or detected earlier, and present this as a risk reduction metric.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which statement best defines cyber threat intelligence?

   • ARaw data about potential threats collected from various sources
   • BA report of past security incidents for compliance purposes
   • CA list of known malware signatures used by antivirus software
   • DInformation that has been analyzed and contextualized to support security decision-making
   Reveal Solution Discussion Select an answer first