CySA+ Test Threat Intelligence 2 — Questions and Answers
Question 1: Which threat intelligence sharing standard uses a JSON-based format to represent cyber threat information as objects and relationships?
- TAXII
- STIX (Correct answer)
- OpenIOC
- MISP
Correct answer: STIX
STIX (Structured Threat Information eXpression) is a JSON-based language for representing CTI objects and their relationships.
Question 2: A security analyst receives a threat report indicating that an APT group uses 'living off the land' techniques. What does this mean?
- The group targets agricultural infrastructure
- The group uses legitimate system tools to avoid detection (Correct answer)
- The group relies on zero-day exploits exclusively
- The group operates only in cloud environments
Correct answer: The group uses legitimate system tools to avoid detection
Living off the land (LotL) refers to attackers using built-in OS tools like PowerShell or WMI to conduct malicious activity, blending in with normal operations.
Question 3: Which MITRE ATT&CK tactic describes an adversary's attempts to steal credentials to gain access to systems?
- Initial Access
- Persistence
- Credential Access (Correct answer)
- Lateral Movement
Correct answer: Credential Access
Credential Access is the ATT&CK tactic covering techniques like keylogging, credential dumping, and brute forcing to obtain account credentials.
Question 4: What is the primary purpose of a threat intelligence platform (TIP)?
- To block malicious traffic at the perimeter
- To aggregate, correlate, and manage threat intelligence from multiple sources (Correct answer)
- To perform automated penetration testing
- To monitor endpoint behavior in real time
Correct answer: To aggregate, correlate, and manage threat intelligence from multiple sources
A TIP centralizes threat data from multiple feeds, enabling analysts to correlate, enrich, and act on intelligence efficiently.
Question 5: An analyst observes that attackers are using domain generation algorithms (DGAs). What is the main defensive value of identifying DGA patterns?
- It allows blocking all DNS traffic
- It enables sinkholing or preemptive blocking of generated domains (Correct answer)
- It identifies the attacker's geographic location
- It decrypts C2 communications automatically
Correct answer: It enables sinkholing or preemptive blocking of generated domains
Identifying DGA patterns allows defenders to predict, sinkhole, or block generated domains before malware establishes C2 communications.
Question 6: Which type of threat intelligence focuses on the day-to-day activities of security operations and includes IOCs, malware hashes, and IP blocklists?
- Strategic intelligence
- Operational intelligence
- Tactical intelligence
- Technical intelligence (Correct answer)
Correct answer: Technical intelligence
Technical intelligence provides specific IOCs such as hashes, IPs, and domains used directly in detection tools and blocklists.
Question 7: A threat analyst is mapping an adversary campaign to the Diamond Model. Which four features are core to this model?
- Actor, capability, infrastructure, victim (Correct answer)
- Threat, vulnerability, exploit, payload
- Tactic, technique, procedure, objective
- Source, indicator, confidence, severity
Correct answer: Actor, capability, infrastructure, victim
The Diamond Model of intrusion analysis consists of four core features: adversary, capability, infrastructure, and victim.
CySA+ Test Threat Intelligence 2
Which threat intelligence sharing standard uses a JSON-based format to represent cyber threat information as objects and relationships?