Threat Intelligence and Vulnerability Management Flashcards

Which threat intelligence sharing format is a community standard for expressing cyber threat indicators in a structured, machine-readable way?

Answer: STIX (Structured Threat Information eXpression)

STIX is an open standard for representing CTI, including threat actors, malware, attack patterns, and IoCs in a structured format.

What does CVSS (Common Vulnerability Scoring System) measure?

Answer: The severity and characteristics of a software vulnerability on a 0-10 scale

CVSS scores vulnerabilities 0-10 based on attack vector, complexity, privileges required, user interaction, and impact metrics.

Which vulnerability management metric tracks the average time from a patch being available to it being deployed?

Answer: Mean Time to Patch (MTTP) or patch cadence

Mean Time to Patch measures the speed of an organization's patching program, with shorter times reducing the exposure window for known vulnerabilities.

What is a zero-day vulnerability?

Answer: A vulnerability unknown to the vendor for which no patch exists

A zero-day is a previously unknown vulnerability that the vendor has had zero days to patch, making it especially dangerous since no fix exists.

Which type of threat intelligence is MOST actionable for a SOC analyst responding to an active incident?

Answer: Operational intelligence (specific indicators like malicious IPs and hashes)

Operational intelligence provides specific, immediately actionable IoCs such as malicious IPs, domains, and file hashes that can be directly used in detection tools.

What is the primary purpose of vulnerability scanning in a CNDA security program?

Answer: To identify and prioritize known weaknesses in systems before attackers can exploit them

Vulnerability scanning discovers known weaknesses, misconfigurations, and missing patches so organizations can remediate the highest risks first.