CySA+ Test Threat Intelligence 2

Question 1

Which threat intelligence sharing standard uses a JSON-based format to represent cyber threat information as objects and relationships?

Accepted Answer

STIX

Answer

STIX (Structured Threat Information eXpression) is a JSON-based language for representing CTI objects and their relationships.

Question 2

A security analyst receives a threat report indicating that an APT group uses 'living off the land' techniques. What does this mean?

Accepted Answer

The group uses legitimate system tools to avoid detection

Answer

Living off the land (LotL) refers to attackers using built-in OS tools like PowerShell or WMI to conduct malicious activity, blending in with normal operations.

Question 3

Which MITRE ATT&CK tactic describes an adversary's attempts to steal credentials to gain access to systems?

Accepted Answer

Credential Access

Answer

Credential Access is the ATT&CK tactic covering techniques like keylogging, credential dumping, and brute forcing to obtain account credentials.

Question 4

What is the primary purpose of a threat intelligence platform (TIP)?

Accepted Answer

To aggregate, correlate, and manage threat intelligence from multiple sources

Answer

A TIP centralizes threat data from multiple feeds, enabling analysts to correlate, enrich, and act on intelligence efficiently.

Question 5

An analyst observes that attackers are using domain generation algorithms (DGAs). What is the main defensive value of identifying DGA patterns?

Accepted Answer

It enables sinkholing or preemptive blocking of generated domains

Answer

Identifying DGA patterns allows defenders to predict, sinkhole, or block generated domains before malware establishes C2 communications.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Threat Intelligence 2