Ucertify 2

Malena works as a cybersecurity analyst in an XYZ company. Her company assigned her to investigate threats using the threat intelligence cycle. Using this process, she started her work by assessing what kinds of security breaches or compromises her company has faced and according to intelligence requirements, she started collecting data from threat intelligence sources. What should be Malena's next step in the given scenario?

Data processing and analysis

Sia works as a cybersecurity analyst at an ABC organization. Her organization uses Lockheed Martin's Cyber Kill Chain process for defenders' model attacks and appropriate defenses. Using this process, she started identifying a target and then created tools to exploit vulnerabilities. What would be Sia's next step in the given scenario?

Delivering of weapons to a target

Alaina discovers that her company's website has defaced with a political message. Which type of threat actor is most likely to occur on her company's website in the given scenario?

Hacktivist

Which type of threat actor includes organizations like anonymous that target governments and businesses for political reasons?

Hacktivists

The United States has threat intelligence sharing centers for major areas like healthcare, aviation, and finance. What are these centers called?

ISAC

Which of the following stages of the Lockheed Martin's Cyber Kill Chain process focuses on persistent backdoor access for attackers?

Installation

Which level of intelligence provides broad information about threats and threat actors, allowing organizations to understand and respond to trends?

Strategic intelligence

Cyn works as a cybersecurity analyst. She wants to send threat information via a standardized protocol specifically designed to exchange cyber threat information. Which of the following should Cyn choose to exchange cyber threat information in the given scenario?

TAXII

Which of the following is specifically designed to support Structured Threat Information Expression (STIX) data exchange?

TAXII

James works as a security analyst in an organization. He wants to select a threat framework for his organization. He preferred a framework that includes steps to identify victims, capabilities, and infrastructure of a cybersecurity event. Which of the following would be James's best choice as per his preferences?

The Diamond Model of Intrusion Analysis

Which of the following threats are nation state-sponsored organizations with significant resources and capabilities and provide the highest level of threat on the adversary tier list?

APTs

Gabby, a cybersecurity analyst, wants to select a threat framework for her organization. She identifies that threat actor tactics in a standardized way is an important part of her selection process. Which threat model would be her best choice for the selection process in the given scenario?

ATT&CK

You work as a security analyst in an organization. You need to select a threat framework for your organization and mainly want threat actor tactics to be in a normalized way. Which threat model would be your best choice for selection in the given scenario?

ATT&CK

Jason works as a security analyst in an organization. He gathers threat intelligence information that explains to him about an adversary which is considered as a threat in his organization. The adversary likes to use USB key drops to compromise their targets. Which of the following options is specified in the given scenario?

An attack vector

Which type of assessment is particularly useful for identifying insider threats?

Behavioral

Which term describes scores that allow organizations to filter and use threat intelligence based on the amount of trust they can give?

Confidence

While engaging in an attack, an attacker sends an email message to the targeted victim that contains malicious software as an attachment. Which phase of the Cyber Kill Chain is occurring in the given scenario?

Delivery

Which of the following measures is not commonly used to assess threat intelligence?

Detail

On which of the following languages is STIX based?

Extensible Markup Language

Which of the organizations did the U.S. government help in sharing threat information to infrastructure owners and operators?

ISACs

Which of the following statements is not true about ATT&CK matrices?

Include metadata like the author, the name of the IOC, and a description.

Which of the following type of threat assessment data uses forensic evidence or data?

Indicators of compromise

The following figure signifies the Diamond Model of Intrusion: Figure A: The Diamond Model of Intrusion What does the question mark symbol represent on each vertex of the given figure?

Infrastructure and capability

Roma works as a penetration tester in an organization. She is performing a penetration test for a customer and identifies a client machine that is downloading the contents of the customer database, which stores the customer's intellectual property. After that, she also identifies an employee who is exporting the downloaded data to a USB drive. Which type of threat actor is being referred to in the given scenario?

Insider threat

Which phase of the Cyber Kill Chain process includes the creation of persistent backdoor access for attackers?

Installation

Which of the following is the common criticism of the Cyber Kill Chain model?

It includes actions outside a defended network.

Which security company creates and provides a base set of indicators of compromise (IOC) used by OpenIOC?

Mandiant

Which of the following threat actors are often associated with advanced persistent threat (APT) organizations?

Nation-state actors

Which of the following threat actors typically has the greatest access to resources?

Nation-state actors

What term describes information from publicly available sources used for intelligence purposes?

OSINT

Sam works as a security analyst in an XYZ company. He sends threat intelligence information to his manager in a machine-readable format so that the manager can verify it. In that format, Mandiant's indicators are used by Sam for the base framework. Which format did Sam use in the given scenario?

OpenIOC

Jack received an unknown call from a girl saying that she is a customer executive calling from an XYZ bank. She informed Jack that he won a prize of $2000 and the same amount will be transferred to his account as he is one of the prime customers of this bank. For this amount transfer, she requested Jack to confirm his debit card details. In the given scenario, the girl is playing which threat actor role?

Organized crime

Which of the following is not a common technique used to defend against command and control (C2) capabilities deployed by attackers?

Patching against zero-day attacks

Which of the following activities ensures that you have reviewed threats, their causes, and their typical actions and processes?

Profiling threat actors and activities

Which of the following options is frequently conducted in the requirements gathering phase of the intelligence cycle?

Review of security breaches or compromises an organization has faced

Which of the following is a standardized Extensible Markup Language (XML) programming language for conveying data about cybersecurity threats in a common language that can be easily understood by humans and security technologies?

STIX

Which six-category threat classification model developed by Microsoft is used to assess threats in an application?

STRIDE

he Diamond Model of Intrusion Analysis uses four main concepts as part of its threat mapping. Which of the following is not one of those four concepts?

Threat

Which of the following drove the creation of ISACs in the United States?

Threat information sharing for infrastructure owners

Which of the following activities follows threat data analysis in the threat intelligence cycle?

Threat intelligence dissemination

STRIDE, PASTA, and LINDDUN are all examples of ________________.

threat classification tools