CREST CREST Threat Intelligence & Risk Assessment 2

Question 1

What is the primary distinction between an Indicator of Compromise (IoC) and an Indicator of Attack (IoA)?

Accepted Answer

IoCs indicate post-compromise evidence; IoAs indicate attacker behaviors in progress

Answer

IoCs (file hashes, IPs, domains) are forensic evidence of a past compromise, while IoAs detect adversary behaviors and TTPs as an attack is occurring.

Question 2

Which threat modeling framework uses the acronym STRIDE to categorize threat types?

Accepted Answer

Microsoft STRIDE model

Answer

Microsoft's STRIDE model categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Question 3

What is an Advanced Persistent Threat (APT) characterized by compared to opportunistic cybercrime?

Accepted Answer

Long-term, stealthy, targeted operations often sponsored by nation-states

Answer

APTs conduct long-duration, stealthy campaigns targeting specific organizations, often with nation-state backing, persistence mechanisms, and strategic intelligence objectives.

Question 4

In the context of threat intelligence sharing, what does STIX/TAXII enable?

Accepted Answer

Standardized machine-readable threat intelligence exchange between organizations

Answer

STIX (Structured Threat Information Expression) defines a common language for threat data, while TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol to share it.

Question 5

What is the purpose of a Threat Intelligence Report's 'executive summary' section?

Accepted Answer

To communicate key findings and business risk in non-technical terms for leadership

Answer

The executive summary translates technical threat findings into business risk language to help executives make informed resource allocation and security decisions.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST CREST Threat Intelligence & Risk Assessment 2