CCD CCD Threat Intelligence & Hunting

Question 1

Which threat intelligence framework uses a matrix of tactics and techniques based on real-world adversary behavior?

Accepted Answer

MITRE ATT&CK

Answer

NIST CSF

Answer

OWASP Top 10

Answer

COBIT

Question 2

What is the primary goal of threat hunting in a security operations context?

Accepted Answer

Proactively search for hidden threats before alerts fire

Answer

Patch known vulnerabilities

Answer

Generate compliance reports

Answer

Block inbound firewall traffic

Question 3

Which threat intelligence indicator type refers to known malicious file hashes, IPs, and domains?

Accepted Answer

IOCs

Answer

TTPs

Answer

CVEs

Answer

ATT&CK Groups

Question 4

What does the 'Diamond Model' of intrusion analysis primarily focus on?

Accepted Answer

Relationships between adversary, capability, infrastructure, and victim

Answer

Patch management lifecycle

Answer

Network topology mapping

Answer

Log retention policies

Question 5

Which STIX/TAXII concept is used to share threat intelligence between organizations in a standardized format?

Accepted Answer

TAXII as transport protocol and STIX as data format

Answer

STIX as transport protocol and TAXII as data format

Answer

Both are data storage formats

Answer

Both are firewall rule languages

Question 6

A threat hunter notices beaconing traffic at regular 5-minute intervals to an external IP. What technique should be used to confirm C2 communication?

Accepted Answer

Analyze beacon jitter, packet size consistency, and DNS lookups to the IP

Answer

Check firewall uptime logs

Answer

Reboot the affected endpoint

Answer

Disable all outbound traffic