CySA Plus V3 Threat Intelligence Analysis

1. In threat intelligence, what does the term 'confidence level' refer to?

The cost of obtaining the intelligence

The degree of certainty in the accuracy of the intelligence

The number of sources reporting the threat

The time required to analyze the threat

2. What is the primary role of threat intelligence in supporting incident response operations?

To provide context about threats and help prioritize response actions

To eliminate the need for forensic investigations

To guarantee prevention of all future incidents

To reduce the cost of security tools

3. A security team receives threat intelligence indicating a zero-day vulnerability. Which action should be prioritized?

Immediately publish the vulnerability details online

Assess impact and implement compensating controls

Wait for public disclosure before taking action

Share the information with all third parties

4. In threat intelligence analysis, what does 'attribution' primarily involve?

Identifying the source or actor responsible for a cyber incident

Creating backups of compromised systems

Encrypting sensitive data

Blocking all network traffic

5. Which framework provides a comprehensive taxonomy of adversary tactics and techniques used in cyberattacks?

NIST Cybersecurity Framework

MITRE ATT&CK

ISO 27001

CIS Controls

6. What is the primary benefit of threat actor profiling in a CySA security program?

To increase network bandwidth

To understand adversary capabilities, intentions, and likely targets

To eliminate all cyber threats

To reduce cybersecurity spending

7. A CySA analyst detects a file hash matching a known malware variant. This represents which type of indicator?

Behavioral indicator

Indicator of Compromise (IOC)

Strategic indicator

Contextual indicator

8. Which intelligence source provides information about threat actors' motivations and long-term strategic goals?

Tactical intelligence

Operational intelligence

Strategic intelligence

Technical indicators

9. What is the primary function of a threat feed in a security operations center (SOC)?

To provide real-time intelligence updates on emerging threats

To eliminate all malware from networks

To replace human security analysts

To encrypt all network traffic

10. Which CySA Plus V3 domain covers the collection and analysis of threat intelligence data?

Threat and Vulnerability Management

Incident Response

Security Architecture and Tool Selection

Cyber Resilience

11. Which type of threat intelligence focuses on indicators such as IP addresses, file hashes, and domains associated with known threats?

Strategic intelligence

Tactical intelligence

Operational intelligence

Contextual intelligence

12. Which malware analysis technique involves running suspect code in a controlled environment to observe its behavior?

Static analysis

Dynamic analysis

Reverse engineering

Pattern matching

13. What is the primary goal of threat intelligence sharing within an Information Sharing and Analysis Center (ISAC)?

To compete with other organizations

To improve collective defense by sharing threat data

To reduce cybersecurity budgets

To eliminate the need for internal security teams

14. A security analyst is tracking a specific threat actor's activities over time. This represents which threat intelligence level?

Tactical

Operational

Strategic

Forensic

15. Which of the following is a characteristic of high-quality threat intelligence?

It is always available at no cost

It is timely, accurate, and relevant to organizational context

It comes exclusively from government sources

It predicts threats with absolute certainty

16. In the context of CySA Plus V3, what does the TTP acronym stand for?

Tactical Threat Protocol

Threat Tracking Procedure

Tactics, Techniques, and Procedures

Technical Threat Prevention

17. What is the main advantage of using open-source intelligence (OSINT) in threat analysis?

It provides classified government data

It is freely available and can be gathered from public sources

It eliminates the need for other intelligence sources

It guarantees 100% accuracy in threat identification

18. A threat intelligence analyst receives a report of suspicious command-and-control (C2) traffic. Which intelligence type would this represent?

Strategic intelligence

Tactical intelligence

Operational intelligence

Predictive intelligence

19. Which framework is commonly used to describe the lifecycle of a cyber attack?

MITRE ATT&CK

Cyber Kill Chain

NIST Cybersecurity Framework

ISO 27001

20. What is the primary purpose of threat modeling in a CySA security program?

To identify and prioritize potential threats to organizational assets

To eliminate all possible security risks

To create backup systems for critical infrastructure

To design encryption algorithms for data protection

CySA Plus V3 Threat Intelligence Analysis Quiz

1. In threat intelligence, what does the term 'confidence level' refer to?

2.

What first name or nickname would you like us to use?

2. What is the primary role of threat intelligence in supporting incident response operations?

3. A security team receives threat intelligence indicating a zero-day vulnerability. Which action should be prioritized?

4. In threat intelligence analysis, what does 'attribution' primarily involve?

5. Which framework provides a comprehensive taxonomy of adversary tactics and techniques used in cyberattacks?

6. What is the primary benefit of threat actor profiling in a CySA security program?

7. A CySA analyst detects a file hash matching a known malware variant. This represents which type of indicator?

8. Which intelligence source provides information about threat actors' motivations and long-term strategic goals?

9. What is the primary function of a threat feed in a security operations center (SOC)?

10. Which CySA Plus V3 domain covers the collection and analysis of threat intelligence data?

11. Which type of threat intelligence focuses on indicators such as IP addresses, file hashes, and domains associated with known threats?

12. Which malware analysis technique involves running suspect code in a controlled environment to observe its behavior?

13. What is the primary goal of threat intelligence sharing within an Information Sharing and Analysis Center (ISAC)?

14. A security analyst is tracking a specific threat actor's activities over time. This represents which threat intelligence level?

15. Which of the following is a characteristic of high-quality threat intelligence?

16. In the context of CySA Plus V3, what does the TTP acronym stand for?

17. What is the main advantage of using open-source intelligence (OSINT) in threat analysis?

18. A threat intelligence analyst receives a report of suspicious command-and-control (C2) traffic. Which intelligence type would this represent?

19. Which framework is commonly used to describe the lifecycle of a cyber attack?

20. What is the primary purpose of threat modeling in a CySA security program?