Threat Prediction with Cyber Threat Intelligence CND Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A threat intelligence analyst wants to collect data on phishing campaigns targeting the organization's employees. The analyst has access to the company's email gateway logs and public OSINT sources. Which collection method would provide the most direct and relevant data?

   • ASubscribe to a general threat intelligence feed
   • BMonitor social media for phishing mentions
   • CAnalyze email gateway logs for phishing indicators
   • DDeploy a honeypot on the internal network
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which stakeholder is most likely to receive tactical threat intelligence?

   • AExecutive board members
   • BSecurity analysts and SOC teams
   • CExternal auditors
   • DMarketing department
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A network defender wants to collect information about attackers targeting the organization's public-facing services. The defender wants to observe attack patterns without exposing real production systems. Which collection method is most appropriate?

   • AMonitor public social media for mentions of the company
   • BDeploy a honeypot that mimics a vulnerable service
   • CEnable verbose logging on all production servers
   • DSubscribe to a commercial threat intelligence feed
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A threat intelligence team is setting up a process to produce weekly reports for management. They have deployed honeypots, subscribed to commercial feeds, and have a SIEM. What is the correct order of the intelligence lifecycle stages they should follow?

   • ADissemination, collection, analysis, and planning.
   • BPlanning and direction, collection, processing, analysis, dissemination, and feedback.
   • CCollection, analysis, planning, dissemination, and feedback.
   • DAnalysis, collection, planning, and dissemination.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A network defender at a mid-sized company notices a surge in scanning activity from IPs in a specific region. The company's IDS logs show repeated attempts to exploit a known vulnerability in the web server. The defender wants to predict whether this is a targeted campaign or opportunistic scanning. Which combination of actions would provide the most actionable prediction?

   • ASearch the internet for public reports of similar scans and then patch the web server immediately.
   • BIncrease the IDS sensitivity to the vulnerability signature and review the logs weekly for any repeat offenders.
   • CCorrelate the scanning IPs with a commercial threat feed and check for related malware hashes in internal sandbox detonations.
   • DBlock all IPs from that region at the firewall and monitor the IDS alerts for a decrease in scan volume.
   Reveal Solution Discussion Select an answer first