GCIA GCIA Threat Intelligence and Attack Patterns

Question 1

What framework categorizes adversary tactics, techniques, and procedures (TTPs) based on real-world observations?

Accepted Answer

MITRE ATT&CK

Answer

MITRE ATT&CK is a globally accessible knowledge base of adversary TTPs derived from real-world attack observations used by SOC teams.

Question 2

Which MITRE ATT&CK tactic describes an adversary maintaining foothold across reboots and credential changes?

Accepted Answer

Persistence

Answer

Persistence tactics allow adversaries to maintain their foothold on a system even after restarts or credential changes.

Question 3

Which stage of the Cyber Kill Chain involves an attacker gathering information about the target organization?

Accepted Answer

Reconnaissance

Answer

Reconnaissance is the first phase of the Cyber Kill Chain where attackers collect information about their target before crafting an attack.

Question 4

What does IOC stand for in the context of threat intelligence?

Accepted Answer

Indicator of Compromise

Answer

Indicators of Compromise are artifacts such as IP addresses, hashes, or domain names observed in a network that indicate a potential intrusion.

Question 5

Which pair of standards is used for structured sharing of cyber threat intelligence?

Accepted Answer

STIX and TAXII

Answer

STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are complementary standards for sharing cyber threat intelligence.

(GCIA) GIAC Certified Intrusion Analyst Practice Test

(GCIA) GIAC Certified Intrusion Analyst Practice Test

GCIA GCIA Threat Intelligence and Attack Patterns