CNDA Threat Intelligence and Vulnerability Management 1 — Questions and Answers
Question 1: Which threat intelligence sharing format is a community standard for expressing cyber threat indicators in a structured, machine-readable way?
- CEF (Common Event Format)
- STIX (Structured Threat Information eXpression) (Correct answer)
- LEEF (Log Event Extended Format)
- NetFlow
Correct answer: STIX (Structured Threat Information eXpression)
STIX is an open standard for representing CTI, including threat actors, malware, attack patterns, and IoCs in a structured format.
Question 2: What does CVSS (Common Vulnerability Scoring System) measure?
- The cost to remediate a vulnerability
- The severity and characteristics of a software vulnerability on a 0-10 scale (Correct answer)
- The number of systems affected by a vulnerability
- The time required to exploit a vulnerability
Correct answer: The severity and characteristics of a software vulnerability on a 0-10 scale
CVSS scores vulnerabilities 0-10 based on attack vector, complexity, privileges required, user interaction, and impact metrics.
Question 3: Which vulnerability management metric tracks the average time from a patch being available to it being deployed?
- MTTD
- Mean Time to Patch (MTTP) or patch cadence (Correct answer)
- CVSS score
- Threat exposure window
Correct answer: Mean Time to Patch (MTTP) or patch cadence
Mean Time to Patch measures the speed of an organization's patching program, with shorter times reducing the exposure window for known vulnerabilities.
Question 4: What is a zero-day vulnerability?
- A vulnerability that has been public for zero days before patching
- A vulnerability unknown to the vendor for which no patch exists (Correct answer)
- A vulnerability with a CVSS score of zero
- A vulnerability in zero-trust architecture
Correct answer: A vulnerability unknown to the vendor for which no patch exists
A zero-day is a previously unknown vulnerability that the vendor has had zero days to patch, making it especially dangerous since no fix exists.
Question 5: Which type of threat intelligence is MOST actionable for a SOC analyst responding to an active incident?
- Strategic intelligence (geopolitical threat landscape)
- Tactical intelligence (TTPs of threat actors targeting your sector)
- Operational intelligence (specific indicators like malicious IPs and hashes) (Correct answer)
- Technical intelligence (vulnerability details)
Correct answer: Operational intelligence (specific indicators like malicious IPs and hashes)
Operational intelligence provides specific, immediately actionable IoCs such as malicious IPs, domains, and file hashes that can be directly used in detection tools.
Question 6: What is the primary purpose of vulnerability scanning in a CNDA security program?
- To exploit vulnerabilities in a controlled manner
- To identify and prioritize known weaknesses in systems before attackers can exploit them (Correct answer)
- To monitor network traffic for intrusions
- To inventory software licenses
Correct answer: To identify and prioritize known weaknesses in systems before attackers can exploit them
Vulnerability scanning discovers known weaknesses, misconfigurations, and missing patches so organizations can remediate the highest risks first.
CNDA Threat Intelligence and Vulnerability Management 1
Which threat intelligence sharing format is a community standard for expressing cyber threat indicators in a structured, machine-readable way?