CySA+ Test Threat Intelligence 3

Question 1

Which confidence scoring model is commonly used in threat intelligence reports to express the analyst's certainty about an assessment?

Accepted Answer

Admiralty Code / Probabilistic language scale

Answer

The Admiralty Code (source reliability + information credibility) and NATO/probabilistic language scales are standard ways to express confidence in intelligence assessments.

Question 2

A security team wants to understand the motivations and long-term goals of a threat actor. Which intelligence tier best addresses this need?

Accepted Answer

Strategic intelligence

Answer

Strategic intelligence addresses high-level adversary motivations, geopolitical context, and long-term trends for executive and policy decision-making.

Question 3

Which TAXII collection type allows a client to both push and pull threat intelligence from a server?

Accepted Answer

Collection

Answer

In TAXII 2.x, a Collection is an interface for sharing STIX objects where clients can query (pull) and optionally push intelligence.

Question 4

An analyst discovers that an IOC flagged in their SIEM was published three years ago and has not appeared in any recent feeds. How should the analyst treat this IOC?

Accepted Answer

Consider it potentially stale and verify its current relevance

Answer

IOCs have a limited lifespan; old indicators may represent infrastructure no longer used by adversaries, requiring freshness validation before acting on them.

Question 5

Which threat actor category is typically motivated by financial gain and operates using ransomware-as-a-service (RaaS) models?

Accepted Answer

Cybercriminal

Answer

Cybercriminals, particularly organized crime groups, commonly monetize attacks through ransomware-as-a-service affiliate programs.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Threat Intelligence 3