Dissemination of Threat Intelligence CTIA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which protocol is specifically designed to transport threat intelligence in a standardized format?

   • AHTTP
   • BSNMP
   • CTAXII
   • DSMTP
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A threat intelligence platform (TIP) vendor wants to enable its customers to share indicators with each other in a standardized, machine-readable format. The vendor also wants to support both real-time and batch sharing. Which combination of standards and protocols should the vendor implement?

   • AJSON for the data format and MQTT for the transport protocol.
   • BSTIX for the data format and TAXII for the transport protocol.
   • CCSV for the data format and email for the transport protocol.
   • DOpenIOC for the data format and REST API for the transport protocol.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A threat intelligence team must disseminate a large volume of indicators to multiple internal security tools and also provide periodic summaries to management. The team has a limited budget and cannot invest in a commercial threat intelligence platform. Which approach is most cost-effective while still meeting the requirements?

   • AManually email indicators to each security tool and create a PDF report for management.
   • BUse a free online spreadsheet to share indicators and rely on management to check it.
   • CPurchase a commercial threat intelligence platform that includes all features.
   • DUse open-source STIX/TAXII tools to automate feeds to security tools and create a simple dashboard for management.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A threat intelligence team at a university wants to disseminate information about a credential-phishing campaign targeting students and faculty. The team has identified that the IT help desk needs to know how to recognize and report the phishing emails, the network security team needs to block the malicious domains, and the university administration needs to understand the potential impact on the institution. Which dissemination method is most effective?

   • APost the full report on the university's website and send a link to all students, faculty, and staff.
   • BHold a campus-wide town hall meeting to present the phishing campaign and answer questions.
   • CProvide the network security team with a technical alert containing IOCs and blocking rules, send the help desk a practical guide with examples and reporting procedures, and give administration an executive summary with risk and impact.
   • DSend a single email to all students, faculty, and staff with the phishing email examples and a link to the full report.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A mid-sized MSSP wants to share threat intelligence with its customers' SIEM platforms automatically. The customers use different SIEM vendors, and the MSSP wants to ensure the intelligence is machine-readable and can be integrated with minimal custom development. Which approach is most appropriate?

   • AProvide a CSV file on a shared FTP server, updated hourly, with columns for IP, domain, hash, and confidence.
   • BCreate a custom JSON API that exposes the MSSP's intelligence in a proprietary format, and provide a client library for each SIEM vendor.
   • CEmail a daily PDF report containing IOCs and recommended actions to each customer's security team.
   • DPublish intelligence in STIX 2.1 format and share it via a TAXII 2.1 server, allowing customers to pull feeds using TAXII clients.
   Reveal Solution Discussion Select an answer first