Threat Intelligence Evaluation and Runbook Creation CTIA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the main benefit of integrating threat intelligence runbooks into security operations workflows?

   • AIt automatically prevents all cyber attacks
   • BIt eliminates the need for security monitoring
   • CIt reduces the need for threat intelligence analysis
   • DIt ensures that response actions are consistently executed
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of scoring and prioritizing threat intelligence?

   • ATo store intelligence in a central repository
   • BTo replace manual analysis with automated tools
   • CTo rank intelligence based on its relevance and actionability for decision-making
   • DTo ensure all intelligence is treated equally
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security operations center (SOC) is creating a runbook for handling a suspected malware infection on a user's workstation. What is the primary purpose of this runbook?

   • ATo automatically remediate the infection without any human intervention.
   • BTo assign blame and identify which user or system was responsible for the infection.
   • CTo provide a standardized, step-by-step guide for the SOC team to respond to the incident consistently.
   • DTo document the technical details of the specific malware family that was detected.
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A SOC is developing a runbook for a new type of attack that exploits a vulnerability in a legacy system. The runbook must be integrated into the existing incident response workflow. The team has limited resources and must decide whether to create a new runbook or modify an existing one. Which approach is most effective?

   • AModify an existing runbook that covers similar attack types, adding specific steps for the legacy system and updating decision points.
   • BCreate a completely new runbook from scratch to ensure it is tailored to the attack.
   • CWait for the vulnerability to be patched before creating a runbook.
   • DUse the existing runbook without changes because it already covers similar attacks.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A threat intelligence analyst is developing a runbook for a new type of ransomware that encrypts files and demands payment. The runbook must guide the incident response team through containment and eradication. Which step should be included as a decision point in the runbook?

   • ARestore all systems from backup without investigating the attack vector.
   • BContact law enforcement before any other action.
   • CDetermine whether to pay the ransom based on the organization's policy and the availability of decryption tools.
   • DImmediately shut down all systems to prevent further encryption.
   Reveal Solution Discussion Select an answer first