Threat Intelligence Evaluation and Runbook Creation CTIA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is evaluating two threat intelligence feeds for a financial institution. Feed A provides detailed indicators of compromise (IOCs) with a 24-hour delay, sourced from a well-known vendor with a strong track record. Feed B provides real-time IOCs from an anonymous researcher's blog, which has been accurate in the past but occasionally publishes unverified data. The institution needs to block an active phishing campaign targeting its customers. Which feed should the analyst prioritize, and why?

   • AFeed B, but only after cross-referencing its IOCs with Feed A and other trusted sources to validate the data before blocking.
   • BFeed A, because the analyst should always prioritize source reliability over timeliness to avoid acting on false positives.
   • CFeed A, because the vendor's reputation and historical accuracy make it more reliable, even though the data is delayed.
   • DFeed B, because the real-time nature of the data is the most critical factor for blocking an active campaign, despite the source's lower reliability.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which factor is most important when prioritizing threat intelligence for immediate action?

   • AThe source's geographic location
   • BThe actionability of the intelligence
   • CThe format of the intelligence report
   • DThe number of indicators in the report
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A threat intelligence analyst is evaluating a new commercial threat intelligence feed. The vendor claims a high confidence score for its indicators. What is the most important factor for the analyst to verify about this confidence score?

   • AThe methodology used to calculate the score is transparent and the score is validated against real-world incidents.
   • BThe score is consistently high across all types of indicators.
   • CThe score is based on a proprietary algorithm that is not publicly disclosed.
   • DThe score is higher than the scores provided by other vendors.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security operations center (SOC) is creating a runbook for responding to a phishing campaign that uses a specific malware dropper. The runbook should standardize the response actions. Which element is most essential to include in the runbook?

   • AA detailed explanation of how phishing attacks work in general.
   • BThe names and contact information of all employees in the organization.
   • CClear triggers, step-by-step response actions, defined roles, and decision points for escalation.
   • DA list of all known phishing campaigns and their historical impact.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is developing a runbook for a new type of attack that involves the abuse of a legitimate remote access tool. The runbook must include steps for the SOC, the incident response team, and the system administrators. What is the most important element to define in the runbook to ensure a coordinated response?

   • AThe name of the threat actor group believed to be responsible for the attack.
   • BThe cost of the remote access tool licenses.
   • CThe roles and responsibilities of each team at each step of the response.
   • DThe specific version of the remote access tool that is being abused.
   Reveal Solution Discussion Select an answer first