CREST Threat Intelligence & Analysis

Question 1

What is the primary purpose of Cyber Threat Intelligence (CTI)?

Accepted Answer

To provide actionable information about threats that helps organizations make better security decisions

Answer

To perform automated vulnerability scanning

Answer

To generate compliance reports for regulators

Answer

To monitor employee activity on corporate networks

Question 2

Which of the following describes a Tactics, Techniques, and Procedures (TTP) in threat intelligence?

Accepted Answer

The behavioral patterns of how threat actors plan and execute attacks

Answer

The list of known malware file hashes

Answer

The IP addresses used by command-and-control servers

Answer

The CVE identifiers for known vulnerabilities

Question 3

What is an Indicator of Compromise (IoC)?

Accepted Answer

A piece of forensic evidence that suggests a system may have been breached

Answer

A warning that a system patch is overdue

Answer

A security policy violation by an employee

Answer

A vulnerability found during a penetration test

Question 4

Which threat intelligence sharing standard uses a structured language to describe cyber threat information in a machine-readable format?

Accepted Answer

STIX (Structured Threat Information eXpression)

Answer

CVSS

Answer

OVAL

Answer

SCAP

Question 5

What is the Diamond Model of Intrusion Analysis used for?

Accepted Answer

Analyzing intrusions by mapping relationships between adversary, capability, infrastructure, and victim

Answer

Visualizing network traffic flows during an attack

Answer

Scoring vulnerabilities based on exploitability

Answer

Categorizing malware families by behavior

Question 6

Which concept in threat intelligence describes the relative difficulty for defenders to detect and respond to different types of indicators?

Accepted Answer

The Pyramid of Pain

Answer

The Kill Chain

Answer

The Diamond Model

Answer

ATT&CK Navigator