Define Tactics, Techniques and Procedures and How They Are Regarded in the Industry. SPLK-5001 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is using threat intelligence to improve their defenses. They have access to a feed that provides detailed TTPs for various adversary groups. The team wants to use this information to proactively identify potential threats to their organization. Which action is most aligned with this goal?

   • ABlock all IP addresses associated with the adversary groups.
   • BShare the TTPs with all employees to increase awareness.
   • CMap the TTPs to the organization's environment and identify gaps in detection coverage.
   • DWait for an attack to occur before using the TTP information.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How does understanding TTPs directly inform the development of detection strategies?

   • AIt focuses detection only on known malware signatures.
   • BIt eliminates the need for monitoring tools.
   • CIt ensures that all detections will have zero false positives.
   • DIt allows detection engineers to focus on the specific behaviors and methods an adversary is likely to use.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations center (SOC) is analyzing a series of intrusions. They notice that the attackers consistently use PowerShell scripts to download and execute payloads, and then use scheduled tasks for persistence. The SOC wants to use this information to attribute the activity to a known threat group. Which approach is most aligned with how TTPs are used in threat intelligence?

   • ASearch for the exact PowerShell script content and scheduled task names on public malware repositories.
   • BExamine the malware's code for unique strings and compile timestamps to identify the developer.
   • CCompare the observed TTPs against a threat intelligence platform's database of known adversary profiles.
   • DAnalyze the network traffic to identify the command-and-control server's IP address and domain.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A threat intelligence team is analyzing a new adversary group that has been observed using a unique combination of TTPs. The team wants to share this information with other organizations in a way that is most useful for defensive purposes. What is the most appropriate way to share this intelligence?

   • APublish a detailed report that includes the TTPs and recommended detection strategies.
   • BKeep the information confidential to avoid alerting the adversary.
   • CShare only the malware hashes and IP addresses observed in the attacks.
   • DShare only the group's name and country of origin.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security manager is reviewing the organization's threat intelligence program. The manager wants to ensure that the program aligns with industry best practices for using TTPs. Which practice should the manager prioritize?

   • AUsing TTPs to identify the identity of individual attackers.
   • BUsing TTPs to create a common language for describing adversary behavior across the industry.
   • CUsing TTPs to replace all IOC-based detection methods.
   • DUsing TTPs to predict the exact timing of future attacks.
   Reveal Solution Discussion Select an answer first