CCD CCD Threat Intelligence & Hunting 1 — Questions and Answers
Question 1: Which threat intelligence framework uses a matrix of tactics and techniques based on real-world adversary behavior?
- MITRE ATT&CK (Correct answer)
- NIST CSF
- OWASP Top 10
- COBIT
Correct answer: MITRE ATT&CK
MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.
Question 2: What is the primary goal of threat hunting in a security operations context?
- Patch known vulnerabilities
- Proactively search for hidden threats before alerts fire (Correct answer)
- Generate compliance reports
- Block inbound firewall traffic
Correct answer: Proactively search for hidden threats before alerts fire
Threat hunting is the proactive practice of searching through networks and systems to detect threats that evade existing automated security controls.
Question 3: Which threat intelligence indicator type refers to known malicious file hashes, IPs, and domains?
- TTPs
- IOCs (Correct answer)
- CVEs
- ATT&CK Groups
Correct answer: IOCs
Indicators of Compromise (IOCs) are forensic artifacts such as file hashes, IP addresses, and domain names associated with known threats.
Question 4: What does the 'Diamond Model' of intrusion analysis primarily focus on?
- Patch management lifecycle
- Relationships between adversary, capability, infrastructure, and victim (Correct answer)
- Network topology mapping
- Log retention policies
Correct answer: Relationships between adversary, capability, infrastructure, and victim
The Diamond Model maps the four core features of every intrusion event: adversary, capability, infrastructure, and victim.
Question 5: Which STIX/TAXII concept is used to share threat intelligence between organizations in a standardized format?
- TAXII as transport protocol and STIX as data format (Correct answer)
- STIX as transport protocol and TAXII as data format
- Both are data storage formats
- Both are firewall rule languages
Correct answer: TAXII as transport protocol and STIX as data format
STIX (Structured Threat Information eXpression) defines the data format while TAXII (Trusted Automated eXchange of Intelligence Information) is the transport protocol.
Question 6: A threat hunter notices beaconing traffic at regular 5-minute intervals to an external IP. What technique should be used to confirm C2 communication?
- Check firewall uptime logs
- Analyze beacon jitter, packet size consistency, and DNS lookups to the IP (Correct answer)
- Reboot the affected endpoint
- Disable all outbound traffic
Correct answer: Analyze beacon jitter, packet size consistency, and DNS lookups to the IP
Analyzing beacon regularity, jitter, packet size, and associated DNS queries helps confirm command-and-control (C2) communication patterns.
CCD CCD Threat Intelligence & Hunting 1
Which threat intelligence framework uses a matrix of tactics and techniques based on real-world adversary behavior?