Threat Intelligence Evaluation and Runbook Creation CTIA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A threat intelligence team is developing a runbook for a new type of phishing attack that uses legitimate cloud services to host malicious files. What is the most critical element to define in the runbook's trigger section?

   • AThe specific email subject lines used in the phishing campaign.
   • BThe names of the cloud services being abused.
   • CThe observable indicators, such as a suspicious URL pattern or a new domain, that would alert the SOC.
   • DThe name of the threat actor group believed to be responsible.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst is evaluating a newly discovered threat intelligence feed that claims to provide real-time indicators of compromise (IOCs) for a specific malware family. The feed is from an unknown researcher with no established reputation. The analyst needs to decide whether to integrate this feed into the organization's detection stack. Which combination of actions best aligns with threat intelligence evaluation and validation principles?

   • AIntegrate the feed but only use it for low-priority alerts to avoid impacting critical systems.
   • BImmediately integrate the feed because real-time IOCs are always valuable for improving detection.
   • CReject the feed solely because the researcher is unknown, regardless of the IOC quality.
   • DCross-reference the IOCs with at least two independent, reputable sources and check the feed's historical accuracy before integrating.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Why is it important to regularly review and update threat intelligence runbooks?

   • ATo satisfy regulatory requirements only
   • BTo keep them aligned with evolving threats and organizational changes
   • CTo make the runbook more complex for analysts
   • DTo increase the number of steps in the runbook
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An analyst receives a threat intelligence report from a new, unknown source claiming a specific IP address is part of a botnet. The analyst checks the IP against a well-known blocklist and finds it listed. However, the analyst also notices the IP belongs to a major cloud provider. What is the most appropriate next step for the analyst to validate this intelligence?

   • AReject the intelligence because the source is unknown and cannot be trusted.
   • BInvestigate the IP's behavior, such as checking for open ports or historical domain associations, to confirm malicious activity.
   • CAccept the intelligence as valid because it is corroborated by a well-known blocklist.
   • DImmediately block the IP address in the firewall to protect the network.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company has a runbook for handling a ransomware incident. After a recent incident, the team realized the runbook did not include a step for communicating with the legal department. What is the most appropriate action to take?

   • AIgnore the missing step, as it is not a technical security control.
   • BDelete the runbook and start over, as it is clearly outdated.
   • CCreate a new, separate runbook specifically for legal communication.
   • DUpdate the existing runbook to include the legal communication step and review it with the team.
   Reveal Solution Discussion Select an answer first