CySA+ Threat Intelligence and IOC Analysis

1. What is the primary purpose of analyzing threat actor TTPs?

To increase network latency

To understand attack patterns and improve defenses

To reduce security staff training

To eliminate password requirements

2. Which framework is commonly used to organize threat intelligence indicators?

MITRE ATT&CK

HTML standards

Social networking protocols

Video streaming formats

3. How frequently should threat intelligence feeds be updated?

Annually

Real-time or near real-time

Every five years

Never

4. What should be included in a threat intelligence report for analysts?

IOCs, context, severity, and recommended actions

Employee names and passwords

Personal social media accounts

Unverified rumors only

5. Which phase of the cyber kill chain benefits most from IOC analysis?

Planning

Detection and response

Budget allocation

Hardware procurement

6. What is a false positive in the context of IOC detection?

An indicator correctly identifying malware

Legitimate activity flagged as malicious

Malware successfully evading detection

A network configuration change

7. How should organizations validate threat intelligence before implementation?

Trust all feeds implicitly

Cross-reference with multiple sources and test in lab

Ignore industry standards

Deploy immediately to production

8. Which IOC type represents a suspicious IP address used in attacks?

Malicious IP address

User login name

Software license key

Hardware serial number

9. What does TTP stand for in threat analysis?

Technical Threat Protocol

Tactics, Techniques, and Procedures

Threat Testing Platform

Transaction Trace Protocol

10. Which tool is commonly used to parse and analyze threat intelligence feeds?

SIEM platforms

Word processors

Video editing software

Email clients only

11. Which of the following is a primary source for obtaining threat intelligence feeds?

Open-source threat intelligence platforms and commercial feeds

Social media posts only

Internal company emails

Employee personal devices

12. Which metric indicates the likelihood that an IOC is accurate?

Confidence level

Processing speed

File size

Update frequency

13. What is a key limitation of relying solely on IOC feeds?

They only detect known threats

They eliminate all false negatives

They reduce network bandwidth usage

They improve employee productivity

14. How should a security analyst prioritize IOCs when responding to threats?

By alphabetical order

By severity, confidence level, and organizational context

Randomly

By creation date only

15. Which IOC type includes suspicious domain names associated with malware?

Command and control (C2) domains

User account names

Software versions

Operating system patches

16. What does STIX stand for?

System Threat Information eXchange

Structured Threat Information eXpression

Security Threat Index eXtension

Strategic Threat Information eXtract

17. Which format is commonly used for sharing structured threat intelligence?

STIX and TAXII

HTML and CSS

JPEG and PNG

PDF only

18. What is the primary benefit of using threat intelligence feeds?

Reducing software licensing costs

Detecting known threats proactively

Replacing manual security monitoring

Eliminating all false positives

19. Which IOC type represents a unique identifier for malware?

File hash

Domain name

IP address

Email address

20. What does IOC stand for in the context of threat analysis?

Internet Outage Control

Indicator of Compromise

Internal Operations Center

Information Output Cache

CySA+ Threat Intelligence Feeds and IOC Analysis Quiz