CAP Threat Intelligence & Analysis 2

Question 1

Which threat intelligence sharing framework uses a structured language called STIX to represent cyber threat information?

Accepted Answer

TAXII

Answer

TAXII (Trusted Automated eXchange of Indicator Information) is the transport protocol used to share STIX-formatted threat intelligence.

Question 2

In the context of threat intelligence, what does the term 'TTPs' stand for?

Accepted Answer

Tactics, Techniques, and Procedures

Answer

TTPs stands for Tactics, Techniques, and Procedures — the behavioral patterns that describe how threat actors operate.

Question 3

A security analyst receives intelligence indicating that a known APT group is targeting organizations in your sector. At what intelligence level is this information MOST useful?

Accepted Answer

Strategic

Answer

Strategic intelligence informs senior leadership about threat actors targeting specific sectors, helping guide risk decisions and resource allocation.

Question 4

Which MITRE framework specifically maps adversary behaviors to detection and mitigation techniques for enterprise environments?

Accepted Answer

MITRE ATT&CK

Answer

MITRE ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) is the knowledge base mapping real-world adversary behaviors to defensive countermeasures.

Question 5

What is the primary purpose of an Indicator of Compromise (IOC)?

Accepted Answer

To identify evidence that a system has been breached

Answer

IOCs are forensic artifacts — such as file hashes, IP addresses, or domain names — that indicate a system may have been compromised.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Threat Intelligence & Analysis 2