Threat Intelligence Data Collection CTIA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What type of data is typically obtained from malware analysis?

   • AThe identity of the attacker who deployed the malware
   • BThe personal opinions of the malware author
   • CIndicators of compromise (IOCs) and behavioral patterns of the malware
   • DThe physical location of the malware's command-and-control server
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   An analyst wants to extract the domain name, path, and query parameters from a suspicious URL to identify the infrastructure used in a phishing campaign. Which technique is most appropriate for this task?

   • APort scanning
   • BWHOIS lookup
   • CURL parsing
   • DDNS reverse lookup
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which email gateway log field is most directly used to identify the originating sender of a suspicious message during threat intelligence collection?

   • ASubject
   • BX-Mailer
   • CEnvelope From
   • DMessage-ID
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A threat intelligence team is investigating a series of targeted attacks against their organization. They have identified a former employee who may have insider knowledge of the attack methods. The team wants to gather human intelligence (HUMINT) from this individual. Which approach is most appropriate?

   • AMonitor the former employee's social media accounts without consent.
   • BUse OSINT tools to gather publicly available information about the former employee.
   • CConduct a structured interview with the former employee, ensuring legal and ethical considerations are addressed.
   • DRequest the former employee's personnel file from HR without a formal process.
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   During a threat intelligence investigation, an analyst identifies a domain that is suspected of being used for command-and-control (C2) communication. Which type of data would the analyst primarily collect to determine the domain's registration details, such as the registrant name and creation date?

   • ASSL certificate transparency logs for the domain
   • BWHOIS records for the domain
   • CDNS A record responses for the domain
   • DNetFlow records from the organization's border router
   Reveal Solution Discussion Select an answer first