Threat Intelligence Evaluation and Runbook Creation CTIA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A SOC is creating a runbook for a new malware variant that propagates via USB drives. The runbook should include steps for containment and eradication. Which component is essential for the runbook to be effective?

   • AInstructions for purchasing new USB devices.
   • BA list of all employees who use USB devices.
   • CA general description of how USB malware works.
   • DSpecific actions for isolating affected systems and procedures for scanning and cleaning USB devices.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security team has a runbook for handling a phishing email. The runbook is stored in a shared folder. After a recent phishing incident, the team made several changes to the runbook. What is the most important step to ensure the runbook remains effective?

   • ADelete the old version of the runbook to avoid confusion.
   • BChange the file name to include the date of the update.
   • CNotify all team members of the changes via email.
   • DSchedule a review meeting to walk through the updated runbook with the team.
   Reveal Solution Discussion Select an answer first
4. 43expert · medium

   A threat intelligence team must prioritize a set of indicators for blocking. The team has limited time and must choose which indicators to block first. The indicators are: (1) a known C2 domain with high confidence, (2) a phishing URL with medium confidence, (3) a file hash with low confidence, and (4) an IP address with high confidence but low relevance to the organization. Which indicator should be blocked first?

   • AThe file hash with low confidence.
   • BThe known C2 domain with high confidence.
   • CThe IP address with high confidence but low relevance.
   • DThe phishing URL with medium confidence.
   Reveal Solution Discussion Select an answer first
5. 44expert · medium

   An organization is evaluating a new threat intelligence source that provides IOCs with a high false-positive rate but also includes valuable context. The organization's SIEM is already generating many alerts. The team must decide whether to integrate the source. Which approach best balances the trade-off?

   • AIntegrate the source only for low-priority alerts to avoid impacting critical systems.
   • BIntegrate the source without any filtering to maximize the intelligence available.
   • CIntegrate the source but use the context to enrich alerts and apply additional filtering to reduce false positives.
   • DReject the source entirely because the false-positive rate is too high.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An analyst is validating a piece of threat intelligence that claims a specific file hash is malicious. The hash was obtained from a private forum. The analyst checks the hash against a public malware repository and finds no match. What should the analyst conclude?

   • AThe intelligence is likely true, as the private forum is a more reliable source.
   • BThe intelligence is unverified, and the analyst should seek additional corroboration from other sources.
   • CThe intelligence is true, but the public repository is outdated.
   • DThe intelligence is likely false, and the hash should be ignored.
   Reveal Solution Discussion Select an answer first