CREST CREST Threat Intelligence & Risk Assessment 3

Question 1

What is the primary goal of threat hunting in a security operations context?

Accepted Answer

Proactively searching for hidden threats that evade automated detection

Answer

Automated vulnerability scanning

Answer

Responding to active security alerts

Answer

Deploying new endpoint protection software

Question 2

In threat modeling, what does 'attack surface' refer to?

Accepted Answer

The sum of all points where an attacker can try to enter or extract data from an environment

Answer

The physical size of a data center

Answer

The number of CVEs affecting a system

Answer

The network bandwidth available for attacks

Question 3

Which assessment methodology specifically evaluates an organization's defenses against real-world threat actor TTPs rather than known vulnerability lists?

Accepted Answer

Red team assessment / adversary simulation

Answer

Compliance audit

Answer

Automated vulnerability scan

Answer

Configuration review

Question 4

What is the difference between a 'white box' and 'black box' penetration test in terms of threat intelligence provided?

Accepted Answer

White box provides full architecture and credentials; black box simulates an external attacker with no prior knowledge

Answer

White box uses automated tools; black box uses manual techniques

Answer

White box is for web apps; black box is for networks

Answer

White box costs less; black box costs more

Question 5

In risk assessment terminology, what is residual risk?

Accepted Answer

Risk remaining after security controls have been applied

Answer

Risk that only affects legacy systems

Answer

Risk identified but not yet scored

Answer

Risk transferred to a third-party insurer

Question 6

Which threat intelligence source provides real-time feeds of known malicious IP addresses, domains, and file hashes?

Accepted Answer

Threat Intelligence Feeds (commercial or open-source OSINT feeds)

Answer

CVE database (NVD)

Answer

NIST SP 800-53 control catalog

Answer

PCAP files from network captures