CREST Threat Intelligence & Analysis

Question 1

What is the primary purpose of Cyber Threat Intelligence (CTI)?

Accepted Answer

To provide actionable information about threats that helps organizations make better security decisions

Answer

CTI collects, processes, and analyzes threat data to produce actionable insights that help defenders prioritize and improve their security posture.

Question 2

Which of the following describes a Tactics, Techniques, and Procedures (TTP) in threat intelligence?

Accepted Answer

The behavioral patterns of how threat actors plan and execute attacks

Answer

TTPs describe the methods and behaviors adversaries use, from high-level strategy (tactics) to specific implementation details (techniques and procedures).

Question 3

What is an Indicator of Compromise (IoC)?

Accepted Answer

A piece of forensic evidence that suggests a system may have been breached

Answer

An IoC is observable evidence such as a malicious IP, domain, file hash, or registry key that indicates a system has likely been compromised.

Question 4

Which threat intelligence sharing standard uses a structured language to describe cyber threat information in a machine-readable format?

Accepted Answer

STIX (Structured Threat Information eXpression)

Answer

STIX is a standardized language for describing CTI content in a structured, machine-readable way that enables automated sharing and analysis of threat data.

Question 5

What is the Diamond Model of Intrusion Analysis used for?

Accepted Answer

Analyzing intrusions by mapping relationships between adversary, capability, infrastructure, and victim

Answer

The Diamond Model provides a framework for understanding intrusions by examining the four core features — adversary, capability, infrastructure, and victim — and their relationships.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Threat Intelligence & Analysis