Threat Actors and Cyber Threat Intelligence (CC) Questions

Question 1

A retail company keeps receiving threat feed alerts warning about a phishing campaign targeting similar businesses in its industry. A security analyst wants to make practical use of this shared information. What is the most appropriate action to take?

Update email filtering rules and alert staff to the reported phishing patterns Archive the shared intelligence reports and review them during the next annual audit Forward the feed alerts to executives for long-term budget planning discussions Wait for the phishing attempts to reach employees before adjusting any defenses

Correct Answer: Update email filtering rules and alert staff to the reported phishing patterns

The correct choice turns threat intelligence into proactive defense by updating email filters and warning staff about the specific phishing patterns before an attack occurs.

Waiting for phishing to reach employees defeats the purpose of early warning and invites compromise. Forwarding to executives for budget planning delays action and ignores the immediate threat. Archiving reports for an annual audit wastes timely, actionable intelligence that requires prompt response.

This question tests the operational use of threat intelligence and information sharing for proactive risk mitigation.

Question 2

A security team wants to reduce false alerts by understanding which threat actors are most likely to target their industry and what methods those actors favor. They plan to feed this understanding into their monitoring rules. Which action best supports this goal?

Enroll every analyst in a general awareness course covering common attack terms Collect current malicious IP lists and refresh firewall blocklists daily Summarize long-term attacker trends into reports for executive budget planning Profile relevant threat actors and map their typical tactics to detection rules

Correct Answer: Profile relevant threat actors and map their typical tactics to detection rules

Profiling relevant threat actors and mapping their tactics, techniques, and procedures directly to detection rules aligns monitoring with realistic industry-specific threats, reducing noise and false alerts.

Collecting malicious IP lists is operational indicator feeding that misses actor behavior and yields short-lived, high-noise results. Summarizing long-term trends into executive reports serves strategic budget planning, not tuning of detection rules. Enrolling analysts in general awareness training builds baseline knowledge but does not refine monitoring logic.

Key concept tested: applying tactical threat intelligence and adversary TTP mapping to improve detection accuracy.

Question 3

In cyber threat intelligence, what does the term 'indicators of compromise' refer to?

Predictive metrics used to forecast an attacker's future targets Policy statements defining acceptable risk thresholds for assets Observable artifacts that suggest a system breach has occurred Behavioral profiles describing a threat actor's typical motivation

Correct Answer: Observable artifacts that suggest a system breach has occurred

Indicators of compromise are observable forensic artifacts, such as malicious IP addresses, file hashes, unusual registry changes, or suspicious network traffic, that provide evidence a system has been breached.

Predictive metrics forecasting future targets describe threat prediction, not evidence of an actual intrusion. Policy statements defining acceptable risk thresholds relate to risk management, not detection artifacts. Behavioral profiles describing a threat actor's motivation align with attribution and threat actor profiling, which is distinct from concrete breach evidence.

The key concept tested is recognizing IOCs as forensic evidence of an intrusion that has already occurred.

Threat Actors and Cyber Threat Intelligence

CC - Threat Actors and Cyber Threat Intelligence Example Questions

Question 1

Question 2

Question 3

Begin Your Cybersecurity Career

Other Domain 5: Security Operations and Incident Response concepts