Threat Prediction with Cyber Threat Intelligence CND Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A threat intelligence analyst needs to gather information about a new ransomware group. They have limited budget and need both technical indicators and strategic context about the group's motivations. Which combination of sources is most appropriate?

   • AA single commercial feed that provides only IP addresses and domains.
   • BOnly internal logs from past incidents involving similar malware.
   • CSocial media posts from the group's alleged members.
   • DOpen-source technical blogs and a free OSINT framework for IoCs, plus industry reports from a trusted security vendor.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What does OSINT stand for in the context of threat intelligence data collection?

   • AOrganized Security Intelligence
   • BOpen Source Intelligence
   • COperational Security Intelligence
   • DOnline System Intelligence
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A small company's security team has identified a new phishing campaign targeting their industry. They want to share this intelligence with other organizations to help prevent the spread. Which approach best balances timely sharing with operational security?

   • APost the raw phishing emails and IoCs on a public blog immediately.
   • BPublish the IoCs to an industry-specific Information Sharing and Analysis Center (ISAC) after sanitizing any sensitive internal details.
   • CWait until the campaign ends and then share a full report with the local CERT.
   • DShare the IoCs only with the company's own employees via an internal email.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst has identified a new command-and-control (C2) domain used by a malware family. The analyst wants to detect any infected hosts on the network. Which IoC would be most effective for this detection?

   • AThe malware's compilation timestamp
   • BThe malware's file size
   • CThe IP address of the malware author
   • DThe domain name itself
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A small organization cannot afford commercial threat intelligence feeds. The security team wants to stay informed about threats relevant to their industry. Which source is most appropriate for this budget constraint?

   • AJoin a free industry Information Sharing and Analysis Center (ISAC)
   • BPurchase a low-cost commercial feed
   • CRely solely on internal network logs
   • DUse social media as the primary source
   Reveal Solution Discussion Select an answer first