CCD CCD Threat Intelligence & Hunting 1

Question 1

Which threat intelligence framework uses a matrix of tactics and techniques based on real-world adversary behavior?

Accepted Answer

MITRE ATT&CK

Answer

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.

Question 2

What is the primary goal of threat hunting in a security operations context?

Accepted Answer

Proactively search for hidden threats before alerts fire

Answer

Threat hunting is the proactive practice of searching through networks and systems to detect threats that evade existing automated security controls.

Question 3

Which threat intelligence indicator type refers to known malicious file hashes, IPs, and domains?

Accepted Answer

IOCs

Answer

Indicators of Compromise (IOCs) are forensic artifacts such as file hashes, IP addresses, and domain names associated with known threats.

Question 4

What does the 'Diamond Model' of intrusion analysis primarily focus on?

Accepted Answer

Relationships between adversary, capability, infrastructure, and victim

Answer

The Diamond Model maps the four core features of every intrusion event: adversary, capability, infrastructure, and victim.

Question 5

Which STIX/TAXII concept is used to share threat intelligence between organizations in a standardized format?

Accepted Answer

TAXII as transport protocol and STIX as data format

Answer

STIX (Structured Threat Information eXpression) defines the data format while TAXII (Trusted Automated eXchange of Intelligence Information) is the transport protocol.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD CCD Threat Intelligence & Hunting 1