Threat Intelligence Data Collection CTIA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the main advantage of dynamic malware analysis over static analysis?

   • AIt reveals the actual behavior of the malware, such as system calls and network activity
   • BIt can always identify the malware author
   • CIt does not require a safe environment to execute the malware
   • DIt is faster and requires fewer resources than static analysis
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why are legal and regulatory sources important for threat intelligence collection?

   • AThey contain the latest malware signatures
   • BThey provide official requirements that may affect how threat data is handled and shared
   • CThey provide real-time attack telemetry
   • DThey list active threat actor groups
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A threat intelligence analyst is reviewing network device logs to identify indicators of compromise. Which log source provides the most direct evidence of a successful or attempted exploit against a specific host?

   • ADHCP logs
   • BFirewall logs
   • CDNS logs
   • DIDS/IPS logs
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is analyzing a targeted phishing campaign against their organization. The team has access to email gateway logs, a sandbox for analyzing attachments, and threat intelligence feeds. The team's goal is to collect indicators of compromise (IOCs) and understand the social engineering tactics used. Which approach would yield the most comprehensive intelligence?

   • AAnalyze email gateway logs to identify the sender, subject, and recipients, and extract any URLs or attachments for sandbox analysis.
   • BSearch threat intelligence feeds for the sender's email address to see if it is known.
   • COnly run the attachment in the sandbox to see what malware it installs.
   • DOnly review the email gateway logs to see which users received the phishing email.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In the context of threat intelligence data collection, what is the primary purpose of continuous monitoring?

   • ATo collect data on a scheduled basis, such as daily or weekly, to reduce system load
   • BTo provide ongoing, real-time or near-real-time collection of data from various sources to detect and respond to threats promptly
   • CTo replace all manual data collection methods with automated tools
   • DTo capture data only after a security incident has been detected
   Reveal Solution Discussion Select an answer first