Threat Intelligence Evaluation and Runbook Creation CTIA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A threat intelligence analyst is reviewing a report that claims a specific domain is used for phishing. The analyst has access to multiple sources, including a commercial feed, a government advisory, and an internal sandbox analysis. Which action best validates the claim?

   • AUse the domain in a phishing simulation to see if it triggers alerts.
   • BCorrelate the domain with the sandbox analysis and check if the commercial feed and government advisory also list the domain.
   • CTrust the government advisory because government sources are always correct.
   • DIgnore the report because commercial feeds are often inaccurate.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the main purpose of cross-referencing threat intelligence with multiple sources?

   • ATo validate the accuracy and reduce false positives
   • BTo make the intelligence more complex
   • CTo increase the volume of data collected
   • DTo ensure the intelligence is stored securely
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A threat intelligence platform (TIP) is ingesting data from multiple sources. The analyst needs to configure the platform to automatically assign a priority score to each indicator. Which criteria should the analyst use to ensure the most relevant and actionable indicators are prioritized?

   • AThe reputation of the source that provided the indicator.
   • BA combination of the indicator's relevance to the organization's industry, its actionability (e.g., can it be blocked), and its confidence score.
   • CThe number of times the indicator has been seen in the wild.
   • DThe age of the indicator, with older indicators being more reliable.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An organization is considering subscribing to a commercial threat intelligence feed. The feed provides a high volume of IOCs, but the organization has limited analyst time to investigate alerts. Which evaluation criterion should be most heavily weighted in the decision?

   • AThe feed's brand recognition, as well-known vendors are always reliable.
   • BThe feed's cost, as cheaper feeds are always better.
   • CThe total number of IOCs provided, as more is always better.
   • DActionability of the IOCs, such as the availability of context and recommended response actions.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which element is essential to include in a runbook to ensure accountability during an incident?

   • AThe personal email addresses of all employees
   • BThe brand of the security tools used
   • CThe assigned roles and responsibilities for each step
   • DThe organization's annual budget
   Reveal Solution Discussion Select an answer first