Threat Intelligence Evaluation and Runbook Creation CTIA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst finds a new malware sample and extracts a domain name that it communicates with. The domain was registered three days ago. To validate this as a malicious domain, what is the most important additional piece of evidence to gather?

   • AA second opinion from a colleague on the sample's behavior.
   • BThe domain's registrar information.
   • CA correlation of the domain with other malware samples or campaigns.
   • DThe domain's DNS records, such as its A record.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A threat intelligence analyst is scoring a new indicator: a command-and-control (C2) domain. The domain is highly relevant to the organization's industry and has a high confidence score from a reputable source. However, the domain is not currently active and has not been seen in the organization's network. How should the analyst score this indicator?

   • ALow priority, because the domain is not currently active.
   • BHigh priority, because the high relevance and confidence outweigh the lack of current activity.
   • CDo not score the indicator, as it is not currently a threat.
   • DMedium priority, because it is relevant and reliable, but not currently actionable.
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   An analyst is validating a report that a specific file hash is associated with a new trojan. The report comes from a single commercial source. The analyst has access to a sandbox that can execute the file, but the file is not yet available. The analyst also has access to a threat intelligence platform that aggregates multiple sources. Which action is most appropriate to validate the report?

   • AWait until the file is available for sandbox analysis before taking any action.
   • BCheck the hash against the threat intelligence platform to see if other sources have also reported it, and note the lack of direct evidence.
   • CTrust the commercial source because it is a paid feed and therefore reliable.
   • DBlock the hash immediately based on the single report.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team has implemented a runbook for incident response. To ensure the runbook is effectively integrated into the SOC's workflow, which action should be taken?

   • APrint the runbook and distribute it to all team members.
   • BStore the runbook in a shared folder that is accessible only to the incident response team.
   • CReview the runbook only after a major incident.
   • DIntegrate the runbook into the ticketing system so that triggers automatically create incidents with the runbook attached.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC receives a high-priority alert from its SIEM about a potential data exfiltration. The alert is based on a new detection rule. The on-call analyst is unsure if the rule has been tested. What should the analyst do first?

   • AIgnore the alert and wait for a second occurrence to confirm it is not a false positive.
   • BCheck the runbook for the 'Data Exfiltration' scenario to see if it includes a validation step for new detection rules.
   • CEscalate the alert to the threat intelligence team for a full analysis.
   • DImmediately isolate the affected system from the network.
   Reveal Solution Discussion Select an answer first