Question 290
A network defender observes a file hash seen in known malware and separately sees the behavior of suspicious credential dumping. Which distinction is accurate?
- A file hash always proves the attacker's identity
- Attack behaviors never matter once an IoC is available
- The hash is an IoC; the credential-dumping behavior is an IoA
- Both observations are only business continuity metrics
Explanation
Correct Answer
C:A compromise indicator is an artifact associated with malicious activity, while an attack indicator reflects actions or techniques as they unfold.
Incorrect Answers
A:A hash may identify content but normally cannot uniquely attribute the actor operating or distributing it.
B:File hashes can change easily, so behavior-based indicators often improve resilience against modified malware samples.
D:Neither an executable hash nor credential dumping measures restoration objectives or outage duration.
Question 291
An intelligence team collects many reports but has not defined who needs the results or what decisions they should support. Which lifecycle step is missing?
- Deleting all previous intelligence assessments
- Choosing malware indicators before establishing intelligence consumers
- Publishing a formatted PDF immediately
- Requirements and direction
- Bulk ingestion alone
Explanation
Correct Answer
D:Defining intelligence questions and decision makers focuses collection and analysis on useful, relevant security outcomes.
Incorrect Answers
A:Discarding prior learning does not establish the analytic objectives for a new intelligence collection effort.
B:A feed may contain valid observables but cannot prioritize the questions leadership or analysts actually need answered.
C:Dissemination before analysis and audience definition risks distributing irrelevant or unsupported conclusions.
E:Collecting more records without requirements can create noise without answering operational questions.
Question 292
Two security products must exchange structured threat observables, relationships, and campaign descriptions using a common machine-readable representation. Which standard fits?
- OpenIOC indicator expressions without a broader intelligence object graph
- STIX
- TAXII collection transport without defining the representation of objects
- A YARA pattern file representing detection rules but not campaign relationships
Explanation
Correct Answer
B:Structured Threat Information Expression models threat intelligence objects and relationships for consistent sharing between systems.
Incorrect Answers
A:OpenIOC can represent indicators and observable tests, but it is not the general threat-entity and relationship representation requested for campaigns and actors.
C:TAXII moves threat intelligence collections between services; STIX supplies the structured observable, actor, campaign, and relationship data model.
D:YARA is valuable for file or process content matching, but a rule file is not a general exchange model for threat intelligence entities and links.
Question 293
An intelligence exchange needs a standard way to query and deliver STIX collections between producers and consumers over an application API. Which protocol is most relevant?
- ICMP echo
- TAXII
- ARP
- DHCP
Explanation
Correct Answer
B:Trusted Automated Exchange of Intelligence Information specifies protocols and services for exchanging structured threat information between clients and servers.
Incorrect Answers
A:Ping measures reachability and cannot manage collections of threat intelligence objects and relationships.
C:ARP maps addresses on local links and does not transport structured threat intelligence collections between organizations.
D:DHCP assigns IP configuration to clients, not an API for discovering and exchanging cyber threat data.
Question 294
A partner shares an alert marked TLP:AMBER. How should recipients interpret this handling guidance under the applicable TLP version?
- Treat the information as legally classified national-security material
- Publish the full bulletin on social media automatically
- Limit sharing to the permitted organizational and client need-to-know scope
- Ignore any limitations once the message is in email
Explanation
Correct Answer
C:TLP:AMBER restricts dissemination beyond the parties who need the information for protective action; recipients should follow source conditions.
Incorrect Answers
A:TLP expresses sharing restrictions among participants and is not the same as government classified-information marking.
B:Broad public distribution conflicts with the controlled-sharing intent signaled by an amber designation.
D:Delivery by email does not override the originator's information-sharing guidance or other confidentiality obligations.
Question 295
An indicator feed offers an IP associated with malware months ago, but the address has since been reassigned. Which analyst action most improves detection quality?
- Matching a reused IP address without checking current DNS and hosting context
- Disable all indicator timestamps in the SIEM
- Assume every reputable feed remains correct indefinitely
- Block the IP permanently without reassessment
- Using only an IOC's severity label from the original report
- Validate indicator freshness, provenance, and current behavioral context
Explanation
Correct Answer
F:Addresses can change owners, making stale IP-only blocking dangerous unless it is reevaluated against present threat evidence.
Incorrect Answers
A:Old infrastructure associations may no longer apply; present ownership and traffic evidence should influence any block decision.
B:Removing age metadata makes it harder to identify stale intelligence or evaluate confidence in a match.
C:Credible sources still contain time-sensitive observables requiring expiration and contextual review.
D:Indefinite blocking of reused addresses can disrupt unrelated legitimate services and inflate false positives.
E:Labels without temporal or asset context do not establish whether the indicator still predicts harmful behavior today.
Question 296
A report attributes a campaign to a named actor but cites only one unverified forum post. How should a threat intelligence analyst treat the attribution?
- Discard all other collected evidence as contradictory noise
- Treat a forum alias as cryptographic proof of identity
- Record low confidence and seek independent corroborating evidence
- Publish the actor name as proven fact immediately
Explanation
Correct Answer
C:Attribution requires evaluating source reliability, analytic assumptions, and alternative explanations before operational or public claims.
Incorrect Answers
A:Competing observations should be examined, not removed merely because they disagree with the initial allegation.
B:Pseudonyms can be impersonated, and online text does not uniquely establish the responsible actor.
D:A single unverified claim does not justify high-confidence attribution and can misdirect defensive effort.
Question 297
An adversary is financially motivated and often uses valid remote-access credentials to reach sensitive data. Which analytical emphasis most helps an organization plan defenses?
- Disable MFA for easier emergency access
- Focus only on the adversary's alleged nickname
- Link observed TTPs and likely objectives to its own identity attack paths
- Ignore credential logs because no malware may be used
Explanation
Correct Answer
C:Capability and motivation help prioritize exposure reduction and detections without relying on uncertain actor-name attribution alone.
Incorrect Answers
A:Weakening authentication increases the exact credential-based access route the threat assessment highlights.
B:A label does not reveal which authentication controls or data paths the organization should secure.
D:Valid-account abuse can leave significant identity and access evidence even without a new malicious executable.
Question 298
A threat hunter suspects attackers are using a rarely used remote administration utility to move between internal servers. What is the strongest starting point?
- Treat absence of antivirus alerts as proof of safety
- Search only for known malicious hashes of the remote administration utility
- Delete all remote access logs before building a query
- Form a testable hypothesis and identify required telemetry
Explanation
Correct Answer
D:A clear behavioral hypothesis links the technique to process, authentication, and network evidence that can confirm or refute it.
Incorrect Answers
A:Legitimate signed administration utilities may be abused without triggering conventional malware signatures.
B:Signed or legitimate remote-administration software can be abused with ordinary file hashes; behavioral and account context are needed to test the lateral-movement hypothesis.
C:Destroying evidence makes it impossible to validate or reject the hypothesis against historical activity.
Question 299
Hunters see remote execution events on servers and need to know whether the pattern is unusual for the environment. Which supporting method is most important?
- Compare events against role-specific baselines and maintenance windows
- Assume any remotely started process is hostile
- Ignore the initiating identity and source host
- Apply a single global remote-process event-count threshold to every server role
Explanation
Correct Answer
A:Known administrative patterns and approved change windows help distinguish routine operations from anomalous lateral activity.
Incorrect Answers
B:Remote management is often legitimate, so classifying all events as malicious creates avoidable false positives.
C:Identity and origin context are important for assessing whether the action matches authorized operations.
D:A global threshold ignores maintenance schedules and differences between database, management, and application servers, producing both false alarms and blind spots.
Question 300
A security operations team is preparing to ingest external indicators at scale. Which THREE controls improve the reliability of resulting detections? Choose THREE.
- Give external feed publishers administrative control of all firewalls
- Enforce indicator expiration and periodic reassessment
- Convert every indicator feed item into a permanent blocking rule based only on feed reputation
- Correlate matches with asset, process, and behavior context
- Treat every feed match as proof of a fully compromised host
- Preserve source provenance and confidence metadata
Explanation
Correct Answers
B:Temporal controls reduce disruption from stale domains and IPs whose meaning changes after their original report.
D:Context distinguishes a genuinely suspicious connection from benign reuse or a low-confidence indicator collision.
F:Analysts need to judge how trustworthy an observable is and whether it should be blocked or merely enriched.
Incorrect Answers
A:Trusted consumption does not require delegating full enforcement authority to third parties or removing local approval boundaries.
C:Blindly enforcing feed entries without expiration or local context can block reassigned legitimate IPs and creates operational disruption without reliably detecting adversaries.
E:Indicators have false positives and varying specificity, so matches require validation before concluding compromise.
