Threat Intelligence Data Collection CTIA Practice Questions (Page 35)

Questions 171–175

1. 171foundation · easy

   Which of the following is a technical source of threat data?

   • AAn interview with a security researcher
   • BA post on a public hacking forum
   • CNetwork traffic captures from a firewall
   • DA report from a government cybersecurity agency
   Reveal Solution Discussion Select an answer first
2. 172foundation · easy

   What type of data is typically collected from a deception technology deployment for threat intelligence purposes?

   • AConfiguration backups of network devices
   • BPerformance metrics of production servers
   • CEncrypted user credentials from legitimate authentication attempts
   • DLogs of attacker interactions, including commands entered and files accessed
   Reveal Solution Discussion Select an answer first
4. 173foundation · easy

   What is the role of an orchestration layer in an automated threat intelligence data collection workflow?

   • AIt stores all collected threat data in a central database
   • BIt provides a user interface for analysts to manually enter threat data
   • CIt coordinates the execution of multiple collection tasks and integrates their outputs
   • DIt performs deep analysis of the collected threat data to identify patterns
   Reveal Solution Discussion Select an answer first
5. 174expert · hard

   A threat intelligence analyst is planning to collect human intelligence (HUMINT) from a former employee of a competitor who now works as a security consultant. The analyst wants to gather insights about the competitor's security posture and potential vulnerabilities. The analyst's organization has a strict code of conduct that prohibits obtaining information through deceptive or coercive means. Which action is most appropriate for the analyst to take?

   • AInterview the consultant openly, explaining the purpose of the research and asking only for publicly available information or general industry insights.
   • BOffer the consultant a financial incentive to disclose confidential information about the competitor.
   • CAsk the consultant to share internal documents from their previous employer.
   • DPose as a potential client to extract detailed information about the competitor's security weaknesses.
   Reveal Solution Discussion Select an answer first
6. 175foundation · easy

   An organization wants to automatically block known malicious IP addresses at its firewall. Which type of data source would be most appropriate for this task?

   • AA public news website that publishes articles about recent cyber attacks.
   • BAn internal vulnerability scanner report listing missing patches on servers.
   • CA dark web monitoring service that provides narrative reports on emerging threats.
   • DA threat intelligence feed providing indicators of compromise in STIX/TAXII format.
   Reveal Solution Discussion Select an answer first