NEW QUESTION 1
Moses, a threat intelligence analyst at InfoTec Inc., wants to find crucial information about the potential threats the organization is facing by using advanced Google search operators. He wants to identify whether any fake websites are hosted at the similar to the organization’s URL.
Which of the following Google search queries should Moses use?

• A. related: www.infothech.org
• B. info: www.infothech.org
• C. link: www.infothech.org
• D. cache: www.infothech.org

Answer: A

NEW QUESTION 2
Andrews and Sons Corp. has decided to share threat information among sharing partners. Garry, a threat analyst, working in Andrews and Sons Corp., has asked to follow a trust model necessary to establish trust between sharing partners. In the trust model used by him, the first organization makes use of a body of evidence in a second organization, and the level of trust between two organizations depends on the degree and quality of evidence provided by the first organization.
Which of the following types of trust model is used by Garry to establish the trust?

• A. Mediated trust
• B. Mandated trust
• C. Direct historical trust
• D. Validated trust

Answer: D

NEW QUESTION 3
Enrage Tech Company hired Enrique, a security analyst, for performing threat intelligence analysis. While performing data collection process, he used a counterintelligence mechanism where a recursive DNS server is employed to perform interserver DNS communication and when a request is generated from any name server to the recursive DNS server, the recursive DNS servers log the responses that are received. Then it replicates the logged data and stores the data in the central database. Using these logs, he analyzed the malicious attempts that took place over DNS infrastructure.
Which of the following cyber counterintelligence (CCI) gathering technique has Enrique used for data collection?

• A. Data collection through passive DNS monitoring
• B. Data collection through DNS interrogation
• C. Data collection through DNS zone transfer
• D. Data collection through dynamic DNS (DDNS)

Answer: B

NEW QUESTION 4
In which of the following forms of bulk data collection are large amounts of data first collected from multiple sources in multiple formats and then processed to achieve threat intelligence?

• A. Structured form
• B. Hybrid form
• C. Production form
• D. Unstructured form

Answer: D

NEW QUESTION 5
Which of the following types of threat attribution deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its target?

• A. Nation-state attribution
• B. True attribution
• C. Campaign attribution
• D. Intrusion-set attribution

Answer: B

NEW QUESTION 6
A network administrator working in an ABC organization collected log files generated by a traffic monitoring system, which may not seem to have useful information, but after performing proper analysis by him, the same information can be used to detect an attack in the network.
Which of the following categories of threat information has he collected?

• A. Advisories
• B. Strategic reports
• C. Detection indicators
• D. Low-level data

Answer: C

NEW QUESTION 7
Karry, a threat analyst at an XYZ organization, is performing threat intelligence analysis. During the data collection phase, he used a data collection method that involves no participants and is purely based on analysis and observation of activities and processes going on within the local boundaries of the organization.
Identify the type data collection method used by the Karry.

• A. Active data collection
• B. Passive data collection
• C. Exploited data collection
• D. Raw data collection

Answer: B

NEW QUESTION 8
Lizzy, an analyst, wants to recognize the level of risks to the organization so as to plan countermeasures against cyber attacks. She used a threat modelling methodology where she performed the following stages:
Stage 1: Build asset-based threat profiles
Stage 2: Identify infrastructure vulnerabilities
Stage 3: Develop security strategy and plans
Which of the following threat modelling methodologies was used by Lizzy in the aforementioned scenario?

• A. TRIKE
• B. VAST
• C. OCTAVE
• D. DREAD

Answer: C

NEW QUESTION 9
Alice, a threat intelligence analyst at HiTech Cyber Solutions, wants to gather information for identifying emerging threats to the organization and implement essential techniques to prevent their systems and networks from such attacks. Alice is searching for online sources to obtain information such as the method used to launch an attack, and techniques and tools used to perform an attack and the procedures followed for covering the tracks after an attack.
Which of the following online sources should Alice use to gather such information?

• A. Financial services
• B. Social network settings
• C. Hacking forums
• D. Job sites

Answer: C

NEW QUESTION 10
Which of the following characteristics of APT refers to numerous attempts done by the attacker to gain entry to the target’s network?

• A. Risk tolerance
• B. Timeliness
• C. Attack origination points
• D. Multiphased

Answer: C

NEW QUESTION 11
Tim is working as an analyst in an ABC organization. His organization had been facing many challenges in converting the raw threat intelligence data into meaningful contextual information. After inspection, he found that it was due to noise obtained from misrepresentation of data from huge data collections. Hence, it is important to clean the data before performing data analysis using techniques such as data reduction. He needs to choose an appropriate threat intelligence framework that automatically performs data collection, filtering, and analysis for his organization.
Which of the following threat intelligence frameworks should he choose to perform such task?

• A. HighCharts
• B. SIGVERIF
• C. Threat grid
• D. TC complete

Answer: D

NEW QUESTION 12
Alison, an analyst in an XYZ organization, wants to retrieve information about a company’s website from the time of its inception as well as the removed information from the target website.
What should Alison do to get the information he needs.

• A. Alison should use SmartWhois to extract the required website information.
• B. Alison should use https://archive.org to extract the required website information.
• C. Alison should run the Web Data Extractor tool to extract the required website information.
• D. Alison should recover cached pages of the website from the Google search engine cache to extract the required website information.

Answer: C

NEW QUESTION 13
A threat analyst obtains an intelligence related to a threat, where the data is sent in the form of a connection request from a remote host to the server. From this data, he obtains only the IP address of the source and destination but no contextual information. While processing this data, he obtains contextual information stating that multiple connection requests from different geo-locations are received by the server within a short time span, and as a result, the server is stressed and gradually its performance has reduced. He further performed analysis on the information based on the past and present experience and concludes the attack experienced by the client organization.
Which of the following attacks is performed on the client organization?

• A. DHCP attacks
• B. MAC spoofing attack
• C. Distributed Denial-of-Service (DDoS) attack
• D. Bandwidth attack

Answer: C

NEW QUESTION 14
During the process of threat intelligence analysis, John, a threat analyst, successfully extracted an indication of adversary’s information, such as Modus operandi, tools, communication channels, and forensics evasion strategies used by adversaries.
Identify the type of threat intelligence analysis is performed by John.

• A. Operational threat intelligence analysis
• B. Technical threat intelligence analysis
• C. Strategic threat intelligence analysis
• D. Tactical threat intelligence analysis

Answer: D

NEW QUESTION 15
A team of threat intelligence analysts is performing threat analysis on malware, and each of them has come up with their own theory and evidence to support their theory on a given malware.
Now, to identify the most consistent theory out of all the theories, which of the following analytic processes must threat intelligence manager use?

• A. Threat modelling
• B. Application decomposition and analysis (ADA)
• C. Analysis of competing hypotheses (ACH)
• D. Automated technical analysis

Answer: C

NEW QUESTION 16
......