CAP Threat Intelligence & Analysis 3

Question 1

A threat intelligence analyst is evaluating a report claiming a nation-state actor is using a specific malware family. Which factor MOST determines the credibility of this intelligence?

Accepted Answer

The reputation and track record of the source

Answer

Source credibility — based on historical accuracy, methodology, and independence — is the primary factor in evaluating the reliability of threat intelligence.

Question 2

What is 'threat hunting' in the context of a cybersecurity program?

Accepted Answer

Proactive search for hidden threats that evade automated detection

Answer

Threat hunting is a proactive, human-led process of iteratively searching through networks and systems to detect threats that automated tools have not flagged.

Question 3

Which kill chain phase involves the adversary researching and identifying targets before an attack?

Accepted Answer

Reconnaissance

Answer

Reconnaissance is the first phase of the Lockheed Martin Cyber Kill Chain, where attackers gather information about their intended target.

Question 4

In threat intelligence, what does 'pivoting' refer to?

Accepted Answer

Using one indicator to discover related indicators and infrastructure

Answer

Pivoting is the analytical technique of using a known IOC (such as a domain or IP) to discover additional related infrastructure and indicators used by the same threat actor.

Question 5

Which type of threat actor is typically characterized by advanced capabilities, long dwell times, and nation-state sponsorship?

Accepted Answer

Advanced Persistent Threats (APTs)

Answer

APTs are sophisticated, well-funded threat actors — typically nation-state affiliated — that conduct long-term, targeted intrusion campaigns with persistence and stealth.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Threat Intelligence & Analysis 3