CREST CREST Threat Intelligence & Risk Assessment

Question 1

What is the MITRE ATT&CK framework primarily used for in threat intelligence?

Accepted Answer

Cataloging adversary tactics, techniques, and procedures (TTPs)

Answer

MITRE ATT&CK is a knowledge base of adversary TTPs observed in real-world attacks, used to improve detection, threat modeling, and red team planning.

Question 2

In threat intelligence, what does the Cyber Kill Chain model describe?

Accepted Answer

The seven stages of a cyberattack from reconnaissance to actions on objectives

Answer

Lockheed Martin's Cyber Kill Chain describes seven attack stages: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives.

Question 3

What is the primary purpose of a Threat Intelligence Platform (TIP) in a security operations context?

Accepted Answer

Aggregating, correlating, and operationalizing threat data from multiple sources

Answer

A TIP collects indicators of compromise (IoCs) and TTPs from multiple feeds, correlates them, and distributes actionable intelligence to security tools and analysts.

Question 4

Which threat intelligence category focuses on understanding adversary motivations, capabilities, and strategic intentions?

Accepted Answer

Strategic intelligence

Answer

Strategic intelligence provides high-level insights about threat actor motivations, geopolitical factors, and long-term adversary campaigns intended for executive decision-making.

Question 5

What does a CVSS (Common Vulnerability Scoring System) base score measure?

Accepted Answer

The intrinsic severity of a vulnerability independent of environment

Answer

The CVSS base score measures inherent vulnerability characteristics like attack vector, complexity, and impact, independent of time or deployment environment.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST CREST Threat Intelligence & Risk Assessment