Threat Intelligence Data Collection CTIA Practice Questions (Page 23)

Questions 111–115

1. 111foundation · easy

   Why are public code repositories like GitHub considered valuable OSINT sources?

   • AThey are a reliable source of information on threat actor identities
   • BThey are the only source of information on zero-day vulnerabilities
   • CThey provide a platform for anonymous communication between threat actors
   • DThey may contain leaked credentials, malicious code, or indicators of attacker TTPs
   Reveal Solution Discussion Select an answer first
2. 112expert · hard

   A threat intelligence analyst is tasked with collecting threat data from a hybrid environment that includes cloud services, IoT devices, and traditional endpoints. The analyst must ensure that data collection does not disrupt critical operations, especially in the OT environment. Which approach best balances comprehensive collection with operational safety?

   • AUse a single data collection tool for all segments to simplify management.
   • BDeploy active scanning tools across all segments to collect as much data as possible.
   • CCollect data only from cloud services and endpoints, ignoring OT and IoT devices.
   • DUse passive collection methods, such as network taps and log aggregation, for OT and IoT segments, while using active collection where safe.
   Reveal Solution Discussion Select an answer first
4. 113application · medium

   A malware analyst receives a suspicious executable file from an incident response engagement. The analyst needs to collect indicators of compromise (IOCs) and behavioral data to enrich the organization's threat intelligence. The analyst has access to a sandbox environment and a static analysis toolkit. Which combination of actions would provide the most comprehensive data for intelligence purposes?

   • AOnly compute the file's hash and search it against public malware databases.
   • BPerform static analysis to extract strings, hashes, and embedded URLs, then run the executable in the sandbox to observe its behavior.
   • CDisassemble the executable using a debugger to understand its logic without executing it.
   • DRun the executable in the sandbox and record network connections, file system changes, and registry modifications.
   Reveal Solution Discussion Select an answer first
5. 114foundation · easy

   What is the primary focus of HUMINT in the context of threat intelligence?

   • ACollecting data from automated technical sensors
   • BAnalyzing publicly available data from the internet
   • CGathering information from human sources through direct interaction
   • DIntercepting and analyzing electronic communications
   Reveal Solution Discussion Select an answer first
6. 115application · medium

   An analyst is tasked with collecting open-source intelligence (OSINT) about a phishing campaign that uses a specific brand impersonation. The analyst needs to gather indicators such as malicious URLs, domains, and email addresses from public sources. Which approach is most efficient and effective?

   • AManually search each social media platform and forum for mentions of the brand.
   • BSubscribe to a commercial threat intelligence feed that provides phishing indicators.
   • CDeploy a honeypot to capture phishing emails related to the brand.
   • DUse an OSINT framework tool like Maltego to automate the collection of related domains, URLs, and email addresses from multiple public sources.
   Reveal Solution Discussion Select an answer first