Spring Sale Special - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: mxmas70

Home > ECCouncil > CTIA > 312-85

312-85 Certified Threat Intelligence Analyst (CTIA) Question and Answers

Question # 4

Which of the following types of threat attribution deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its target?

A.

Nation-state attribution

B.

True attribution

C.

Campaign attribution

D.

Intrusion-set attribution

Full Access
Question # 5

John, a threat intelligence analyst in CyberTech Company, was asked to obtain information that provides greater insight into the current cyber risks. To gather such information, John needs to find the answers to the following questions:

    Why the organization might be attacked?

    How the organization might be attacked?

    Who might be the intruders?Identify the type of security testing John is going to perform.

A.

White box testing

B.

Intelligence-led security testing

C.

Black box testing

Full Access
Question # 6

Alice, a threat intelligence analyst at HiTech Cyber Solutions, wants to gather information for identifying emerging threats to the organization and implement essential techniques to prevent their systems and networks from such attacks. Alice is searching for online sources to obtain information such as the method used to launch an attack, and techniques and tools used to perform an attack and the procedures followed for covering the tracks after an attack.

Which of the following online sources should Alice use to gather such information?

A.

Financial services

B.

Social network settings

C.

Hacking forums

D.

Job sites

Full Access
Question # 7

Two cybersecurity teams from different organizations joined forces to combat a rapidly evolving malware campaign targeting their industry. They exchange real-time information about the attackers’ techniques, compromised systems, and immediate defensive actions. What type of threat intelligence sharing characterizes this collaboration?

A.

Sharing tactical threat intelligence

B.

Sharing operational threat intelligence

C.

Sharing strategic threat intelligence

D.

Sharing technical threat intelligence

Full Access
Question # 8

You are a Security Operations Center (SOC) analyst responsible for monitoring and safeguarding the organization’s network. During routine activities, you identify a potential vulnerability that can expose critical systems to exploitation. In what specific aspect of cybersecurity would you actively engage in when addressing and mitigating this vulnerability?

A.

Threat intelligence analysis

B.

Vulnerability management

C.

Security awareness training

D.

Incident response

Full Access
Question # 9

An autonomous robot was deployed to navigate and learn about the environment. Through a trial-and-error process, the robot refines its actions based on positive or negative feedback to maximize cumulative rewards.

What type of machine learning will the robot employ in this scenario?

A.

Unsupervised learning

B.

Semi-supervised learning

C.

Reinforcement learning

D.

Supervised learning

Full Access
Question # 10

Bob, a threat analyst, works in an organization named TechTop. He was asked to collect intelligence to fulfil the needs and requirements of the Red Tam present within the organization.

Which of the following are the needs of a RedTeam?

A.

Intelligence related to increased attacks targeting a particular software or operating system vulnerability

B.

Intelligence on latest vulnerabilities, threat actors, and their tactics, techniques, and procedures (TTPs)

C.

Intelligence extracted latest attacks analysis on similar organizations, which includes details about latest threats and TTPs

D.

Intelligence that reveals risks related to various strategic business decisions

Full Access
Question # 11

Alison, an analyst in an XYZ organization, wants to retrieve information about a company’s website from the time of its inception as well as the removed information from the target website.

What should Alison do to get the information he needs.

A.

Alison should use SmartWhois to extract the required website information.

B.

Alison should use https://archive.org to extract the required website information.

C.

Alison should run the Web Data Extractor tool to extract the required website information.

D.

Alison should recover cached pages of the website from the Google search engine cache to extract the required website information.

Full Access
Question # 12

In which of the following forms of bulk data collection are large amounts of data first collected from multiple sources in multiple formats and then processed to achieve threat intelligence?

A.

Structured form

B.

Hybrid form

C.

Production form

D.

Unstructured form

Full Access
Question # 13

Flora, a threat intelligence analyst at PanTech Cyber Solutions, is working on a threat intelligence program. She is trying to collect the company's crucial information through online job sites.

Which of the following information will Flora obtain through job sites?

A.

Hardware and software information, network-related information, and technologies used by the company

B.

Top-level domains and subdomains of the company

C.

Open ports and services

Full Access
Question # 14

Jian is a member of the security team at Trinity, Inc. He was conducting a real-time assessment of system activities in order to acquire threat intelligence feeds. He acquired feeds from sources like honeynets, P2P monitoring. infrastructure, and application logs.

Which of the following categories of threat intelligence feed was acquired by Jian?

A.

Internal intelligence feeds

B.

External intelligence feeds

C.

CSV data feeds

D.

Proactive surveillance feeds

Full Access
Question # 15

ABC is a well-established cyber-security company in the United States. The organization implemented the automation of tasks such as data enrichment and indicator aggregation. They also joined various communities to increase their knowledge about the emerging threats. However, the security teams can only detect and prevent identified threats in a reactive approach.

Based on threat intelligence maturity model, identify the level of ABC to know the stage at which the organization stands with its security and vulnerabilities.

A.

Level 2: increasing CTI capabilities

B.

Level 3: CTI program in place

C.

Level 1: preparing for CTI

D.

Level 0: vague where to start

Full Access
Question # 16

What term describes the trust establishment process, wherein the first organization relies on a body of evidence presented to the second organization, and the level of trust is contingent upon the degree and quality of evidence provided by the initiating organization?

A.

Mandated trust

B.

Direct historical trust

C.

Validated trust

D.

Mediated trust

Full Access
Question # 17

Mr. Bob, a threat analyst, is performing analysis of competing hypotheses (ACH). He has reached to a stage where he is required to apply his analysis skills effectively to reject as many hypotheses and select the best hypotheses from the identified bunch of hypotheses, and this is done with the help of listed evidence. Then, he prepares a matrix where all the screened hypotheses are placed on the top, and the listed evidence for the hypotheses are placed at the bottom.

What stage of ACH is Bob currently in?

A.

Diagnostics

B.

Evidence

C.

Inconsistency

D.

Refinement

Full Access
Question # 18

Sam works as an analyst in an organization named InfoTech Security. He was asked to collect information from various threat intelligence sources. In meeting the deadline, he forgot to verify the threat intelligence sources and used data from an open-source data provider, who offered it at a very low cost. Through it was beneficial at the initial stage but relying on such data providers can produce unreliable data and noise putting the organization network into risk.

What mistake Sam did that led to this situation?

A.

Sam used unreliable intelligence sources.

B.

Sam used data without context.

C.

Sam did not use the proper standardization formats for representing threat data.

D.

Sam did not use the proper technology to use or consume the information.

Full Access
Question # 19

Daniel is a professional hacker whose aim is to attack a system to steal data and money for profit. He performs hacking to obtain confidential data such as social security numbers, personally identifiable information (PII) of an employee, and credit card information. After obtaining confidential data, he further sells the information on the black market to make money.

Daniel comes under which of the following types of threat actor.

A.

Industrial spies

B.

State-sponsored hackers

C.

Insider threat

D.

Organized hackers

Full Access
Question # 20

Tech Crunch Inc. has hired John, who is a professional threat intelligence analyst. He was asked to conduct threat intelligence analysis that provides contextual information about the security events and incidents that further help the organization to disclose potential risks, provide greater insight into attacker methodologies, identify past malicious activities, and perform investigations on malicious activities in a more efficient way.

Identify the type of threat intelligence John is going to perform for the organization.

A.

Operational threat intelligence

B.

Strategic threat intelligence

C.

Technical threat intelligence

D.

Tactical threat intelligence

Full Access
Question # 21

Mario is working as an analyst in an XYZ organization in the United States. He has been asked to prepare a threat landscape report to provide in-depth awareness and greater insight into the threats his organization is facing.

Which of the following details should he include to prepare a threat landscape report?

A.

A summary of threat actors most likely targeting the organization along with their motivations, intentions, and TTPs

B.

Attribution of an attack to specific threat actor or group

C.

Attacker's motivation and intention behind the attack

D.

History of an attack and location where it was performed

Full Access
Question # 22

Philip, a professional hacker, is planning to attack an organization. In order to collect information, he covertly collects information from the target person by maintaining a personal or other relationship with the target person.

Which of the following intelligence sources is used by Philip to collect information about the target organization?

A.

CHIS

B.

MASINT

C.

SOCMINT

D.

FISINT

Full Access
Question # 23

Steve is working as an analyst for Highlanders & Co. While performing data analysis, he used a method in which he included a list of all activities required to complete the project, time, dependencies, and logical endpoints such as milestones to acquire information about the relationship between various activities and the period of the activities obtained.

Which of the following data analysis methods was used by Steve?

A.

Critical path analysis

B.

Timeline analysis

C.

Cone of plausibility

D.

Analogy analysis

Full Access
Question # 24

Tech Knights Inc., a small-scale company, has decided to share the intelligence information with various organizations using a nonprofit association that provides a secure place to accumulate and share the information about cyber threats in the industry, and it also provides an extended service of data analysis to the organizational network.

Which of the following types of sharing organizations should Tech Knights Inc. use to share information?

A.

Trading partners

B.

Information Sharing and Analysis Centers (ISACs)

C.

Informal contacts

D.

Commercial vendors

Full Access
Question # 25

SecurityTech Inc. is developing a TI plan where it can drive more advantages in less funds. In the process of selecting a TI platform, it wants to incorporate a feature that ranks elements such as intelligence sources, threat actors, attacks, and digital assets of the organization, so that it can put in more funds toward the resources which are critical for the organization’s security.

Which of the following key features should SecurityTech Inc. consider in their TI plan for selecting the TI platform?

A.

Search

B.

Open

C.

Workflow

D.

Scoring

Full Access
Question # 26

Organizations must choose the right threat intelligence platform to assess and leverage intelligence information, monitor multiple enforcement points, manage intelligence feeds, and select appropriate security for digital assets.

Which of the following key factors ensures that the threat intelligence platform offers a structured way to perform investigations on attacks by processing the threat intelligence and utilizing internal security controls to automate the detection process?

A.

Scoring

B.

Search

C.

Workflow

D.

Open

Full Access