Threat Intelligence Evaluation and Runbook Creation CTIA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A threat intelligence team has collected three pieces of intelligence: (1) a report on a new ransomware strain targeting a different industry, (2) a real-time alert about a phishing kit being used against the company's own domain, and (3) a historical analysis of a vulnerability in a legacy system that is no longer in use. The team must prioritize its response. Which piece of intelligence should be scored and prioritized as the highest impact?

   • AThe real-time alert about the phishing kit, because it is directly targeting the company and requires immediate action.
   • BAll three should be prioritized equally, as they all contribute to the overall threat landscape.
   • CThe historical analysis of the vulnerability, because it provides deep technical detail.
   • DThe report on the new ransomware strain, because it represents a new and emerging threat.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst receives a threat intelligence report from an internal source that a specific IP address is part of a command-and-control (C2) infrastructure. Before blocking the IP address, the analyst wants to validate the intelligence. Which action is most appropriate?

   • AIgnore the report because single-source intelligence is never trustworthy.
   • BShare the IP address with all employees to increase awareness.
   • CBlock the IP address immediately because internal sources are always reliable.
   • DCheck the IP address against multiple threat intelligence platforms and correlate with internal network logs for any connections.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of a threat intelligence runbook?

   • ATo document the history of past cyber attacks
   • BTo replace the need for security analysts
   • CTo standardize response actions for specific threat scenarios
   • DTo store raw threat intelligence data
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is validating a report from a government CERT about a new malware strain. The report includes a detailed technical analysis and IOCs. The analyst's own sandbox analysis of a sample from the report confirms the behavior. However, the analyst cannot find any other independent source that mentions this malware. What is the most appropriate conclusion?

   • AThe intelligence is likely valid, but the analyst should note the lack of independent corroboration and continue to monitor for additional sources.
   • BThe intelligence is valid, and the analyst should immediately block all IOCs.
   • CThe intelligence is invalid, as it has not been corroborated by other sources.
   • DThe intelligence is valid, as the government CERT is a highly reliable source and the sandbox analysis confirms it.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An analyst is evaluating a new threat intelligence feed. Which factor most directly indicates the source's reliability?

   • AThe source has a consistent track record of accurate reporting
   • BThe feed uses a standardized format like STIX
   • CThe feed includes indicators from multiple countries
   • DThe feed is updated every hour
   Reveal Solution Discussion Select an answer first