CREST CREST Threat Intelligence & Risk Assessment 2 — Questions and Answers
Question 1: What is the primary distinction between an Indicator of Compromise (IoC) and an Indicator of Attack (IoA)?
- IoCs are file hashes; IoAs are IP addresses
- IoCs indicate post-compromise evidence; IoAs indicate attacker behaviors in progress (Correct answer)
- IoAs are CVSS scores; IoCs are CVE IDs
- IoCs are proactive; IoAs are reactive
Correct answer: IoCs indicate post-compromise evidence; IoAs indicate attacker behaviors in progress
IoCs (file hashes, IPs, domains) are forensic evidence of a past compromise, while IoAs detect adversary behaviors and TTPs as an attack is occurring.
Question 2: Which threat modeling framework uses the acronym STRIDE to categorize threat types?
- NIST RMF
- Microsoft STRIDE model (Correct answer)
- OWASP SAMM
- FAIR model
Correct answer: Microsoft STRIDE model
Microsoft's STRIDE model categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
Question 3: What is an Advanced Persistent Threat (APT) characterized by compared to opportunistic cybercrime?
- Faster attack execution
- Long-term, stealthy, targeted operations often sponsored by nation-states (Correct answer)
- Focus on financial fraud only
- Exclusive use of zero-day exploits
Correct answer: Long-term, stealthy, targeted operations often sponsored by nation-states
APTs conduct long-duration, stealthy campaigns targeting specific organizations, often with nation-state backing, persistence mechanisms, and strategic intelligence objectives.
Question 4: In the context of threat intelligence sharing, what does STIX/TAXII enable?
- Automated patch deployment
- Standardized machine-readable threat intelligence exchange between organizations (Correct answer)
- SSL certificate management
- Network traffic encryption
Correct answer: Standardized machine-readable threat intelligence exchange between organizations
STIX (Structured Threat Information Expression) defines a common language for threat data, while TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol to share it.
Question 5: What is the purpose of a Threat Intelligence Report's 'executive summary' section?
- To provide raw IoC feeds for SIEM ingestion
- To communicate key findings and business risk in non-technical terms for leadership (Correct answer)
- To list CVE numbers and CVSS scores
- To provide step-by-step remediation scripts
Correct answer: To communicate key findings and business risk in non-technical terms for leadership
The executive summary translates technical threat findings into business risk language to help executives make informed resource allocation and security decisions.
Question 6: Which risk quantification model converts cybersecurity risk into financial terms using probabilistic analysis?
- DREAD
- CVSS
- FAIR (Factor Analysis of Information Risk) (Correct answer)
- STRIDE
Correct answer: FAIR (Factor Analysis of Information Risk)
The FAIR model quantifies cybersecurity risk in monetary terms by analyzing threat event frequency, vulnerability, and loss magnitude using probabilistic ranges.
CREST CREST Threat Intelligence & Risk Assessment 2
What is the primary distinction between an Indicator of Compromise (IoC) and an Indicator of Attack (IoA)?