CySA+ Test Threat Intelligence 4

Question 1

Which open-source platform is widely used for sharing and collaborating on threat intelligence within a community, supporting STIX/TAXII natively?

Accepted Answer

MISP

Answer

MISP (Malware Information Sharing Platform) is an open-source TIP designed for community-based sharing of threat intelligence with STIX/TAXII support.

Question 2

During threat hunting, an analyst uses the hypothesis: 'An adversary has established persistence using scheduled tasks.' Which ATT&CK technique should they investigate first?

Accepted Answer

T1053 – Scheduled Task/Job

Answer

T1053 (Scheduled Task/Job) directly maps to persistence via scheduled tasks and should be the starting point for this hypothesis.

Question 3

What is the purpose of a kill chain analysis in threat intelligence?

Accepted Answer

To map attacker actions to stages in order to identify defensive intervention points

Answer

Kill chain analysis maps adversary activities to sequential stages (e.g., Lockheed Martin Cyber Kill Chain), revealing where defenders can disrupt the attack.

Question 4

An analyst is evaluating a threat intelligence source that frequently reports on threats irrelevant to the organization's industry. Which intelligence characteristic is this source failing to meet?

Accepted Answer

Relevance

Answer

Relevance measures how applicable the intelligence is to the organization's specific environment, industry, and threat landscape.

Question 5

Which technique involves registering domains that are visually similar to legitimate domains to trick users, and is commonly tracked in threat intelligence?

Accepted Answer

Typosquatting/homograph attack

Answer

Typosquatting and homograph attacks use look-alike domains (e.g., 'paypa1.com' or Unicode lookalikes) to deceive users into visiting malicious sites.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Threat Intelligence 4