CCP Cyber Threat Intelligence Lifecycle 3

Question 1

Which CTI sharing standard is specifically designed to represent structured information about cyber threats and is commonly paired with TAXII for transport?

Accepted Answer

STIX

Answer

STIX (Structured Threat Information eXpression) is the standard format for representing CTI, and TAXII is the protocol used to transport STIX data between organizations.

Question 2

During the Collection phase, a CTI team leverages a commercial threat feed, dark web monitoring, and internal SIEM logs. This approach exemplifies which collection strategy?

Accepted Answer

Multi-source collection

Answer

Multi-source collection aggregates data from diverse internal and external sources to improve coverage and reduce blind spots in threat visibility.

Question 3

An analyst notices that a threat actor's TTPs closely match MITRE ATT&CK technique T1566 (Phishing). In which CTI lifecycle phase would this technique mapping most likely occur?

Accepted Answer

Analysis

Answer

Mapping observed behaviors to ATT&CK techniques is an analytical task performed during the Analysis phase to contextualize adversary actions.

Question 4

What is the primary risk of disseminating CTI products that contain outdated or expired indicators of compromise?

Accepted Answer

Increased false positives and alert fatigue

Answer

Expired IOCs generate false positives, eroding analyst trust in the intelligence program and consuming resources on non-existent threats.

Question 5

A threat intelligence platform (TIP) is most useful in which phase of the CTI lifecycle?

Accepted Answer

Collection and Processing

Answer

TIPs are primarily used during Collection to aggregate feeds and Processing to normalize, enrich, and deduplicate threat data before analysis.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP Cyber Threat Intelligence Lifecycle 3