Threat Intelligence Evaluation and Runbook Creation CTIA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team has created a runbook for handling DDoS attacks. To ensure the runbook remains effective, which practice should be established?

   • AShare the runbook only with senior management to protect sensitive information.
   • BSchedule regular reviews and updates based on lessons learned from incidents and changes in the threat landscape.
   • CDelete the runbook after each incident to prevent outdated procedures from being used.
   • DKeep the runbook unchanged to maintain consistency and avoid confusion.
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A security team has implemented a runbook for phishing incidents. After a recent phishing incident, the team identified that the runbook did not include steps for handling a new type of phishing that uses SMS messages. The team must update the runbook. Which approach best ensures the runbook remains effective?

   • AUpdate the runbook only when a new phishing type is discovered.
   • BKeep the runbook unchanged and rely on analyst experience to handle SMS phishing.
   • CAdd a new section for SMS phishing, including triggers, steps, and decision points, and schedule a review of the entire runbook.
   • DReplace the entire runbook with a new one that focuses only on SMS phishing.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which action is part of provenance checks when validating threat intelligence?

   • AConverting the intelligence to a different format
   • BDeleting outdated indicators
   • CReviewing the source's historical accuracy
   • DEncrypting the intelligence data
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which set of criteria is most appropriate for evaluating the quality and reliability of a threat intelligence source?

   • ATimeliness, actionability, and impact
   • BCost, availability, and scalability
   • CFormat, language, and presentation
   • DRelevance, accuracy, and confidence
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   An analyst is validating a threat intelligence report that a specific IP address is part of a botnet. The report is from a single source. The analyst has access to internal logs that show connections to the IP address from a few internal hosts. The analyst also has access to a threat intelligence platform that aggregates multiple sources. Which action best validates the report?

   • AIgnore the report because it is from a single source.
   • BBlock the IP address immediately because internal logs show connections.
   • CShare the IP address with other organizations to get their opinion.
   • DCorrelate the internal logs with the IP address and check the threat intelligence platform for corroboration from other sources.
   Reveal Solution Discussion Select an answer first