MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. Which of the following is a type of cyberthreat intelligence that focuses on understanding attacker motivations and long-term trends?
   a. Strategic intelligence
   b. Tactical intelligence
   c. Technical intelligence
   d. Operational intelligence
   Answer: a. Strategic intelligenceexabeam+1​
2. Which intelligence type focuses on specific indicators of compromise such as IP addresses or file hashes?
   a. Strategic
   b. Tactical
   c. Technical
   d. Operational
   Answer: c. Technicalpaloaltonetworks+1​
3. Which source provides publicly available cybersecurity information and data?
   a. Open Source Intelligence (OSINT)
   b. Commercial Intelligence
   c. Internal Intelligence
   d. Community Intelligence
   Answer: a. Open Source Intelligence (OSINT)anomali​
4. CISA advisories fall under which threat intelligence source category?
   a. OSINT
   b. Commercial
   c. Internal
   d. Community
   Answer: a. OSINTanomali​
5. Internal threat intelligence is derived from which of the following?
   a. Security logs and incidents within the organization
   b. Data from government agencies
   c. Threat feeds from vendors
   d. Data from social media
   Answer: a. Security logs and incidents within the organizationanomali​
6. MISP is an example of a:
   a. Threat intelligence sharing platform
   b. Anti-virus software
   c. Network monitoring system
   d. Penetration testing framework
   Answer: a. Threat intelligence sharing platformitexamanswers​
7. STIX stands for:
   a. Structured Threat Information Expression
   b. Standard Threat Intelligence Exchange
   c. Secure Threat Integration Exchange
   d. Security Threat Info Exchange
   Answer: a. Structured Threat Information Expressionitexamanswers​
8. TAXII is primarily used for:
   a. Exchanging threat intelligence
   b. Encrypting cybersecurity data
   c. Conducting malware analysis
   d. Managing firewalls
   Answer: a. Exchanging threat intelligenceitexamanswers​
9. The Open Threat Exchange (OTX) is run by:
   a. LevelBlue Labs (formerly AlienVault)
   b. Cisco
   c. CrowdStrike
   d. Microsoft
   Answer: a. LevelBlue Labs (formerly AlienVault)wiz​
10. Spamhaus specializes in providing threat intelligence about:
    a. Email spam and malware sources
    b. Software vulnerabilities
    c. Web application attacks
    d. Insider threats
    Answer: a. Email spam and malware sourceswiz​
11. OpenPhish provides intelligence related to:
    a. Phishing threats
    b. Ransomware families
    c. Botnet C2 servers
    d. Vulnerability databases
    Answer: a. Phishing threatswiz​
12. HoneyDB gathers intelligence by:
    a. Deploying honeypots to study attacker behavior
    b. Running antivirus signatures
    c. Monitoring financial transactions
    d. Collecting user reports
    Answer: a. Deploying honeypots to study attacker behaviorwiz​
13. CrowdSec feeds focus on identifying:
    a. Malicious IP addresses across the globe
    b. Network bandwidth issues
    c. OS vulnerabilities in systems
    d. Known phishing websites
    Answer: a. Malicious IP addresses across the globewiz​
14. Shadowserver provides intelligence through:
    a. Daily network remediation reports
    b. Vulnerability patch updates
    c. Antivirus databases
    d. Certification exams
    Answer: a. Daily network remediation reportswiz​
15. SANS Internet Storm Center offers:
    a. Global threat activity data and analysis
    b. VPN security testing
    c. Cloud penetration testing
    d. Security compliance templates
    Answer: a. Global threat activity data and analysiswiz​
16. A Threat Intelligence Platform (TIP) is used to:
    a. Aggregate, analyze, and share threat data
    b. Backup corporate data
    c. Encrypt storage volumes
    d. Manage antivirus licenses
    Answer: a. Aggregate, analyze, and share threat dataitexamanswers​
17. The Center for Internet Security (CIS) mainly provides:
    a. Security benchmarks and controls
    b. Hardware performance standards
    c. Blockchain validations
    d. Network speed optimizations
    Answer: a. Security benchmarks and controlsitexamanswers​
18. The Forum of Incident Response and Security Teams (FIRST) enables:
    a. Cooperation among global response teams
    b. File system encryption
    c. Malware sandboxing
    d. Cloud policy enforcement
    Answer: a. Cooperation among global response teamsitexamanswers​
19. The MITRE Corporation maintains:
    a. CVE databases
    b. STIX/TAXII protocols
    c. VirusTotal
    d. Cloudflare networks
    Answer: a. CVE databasesitexamanswers​
20. The U.S. DHS service for sharing cyberthreat indicators in real time is called:
    a. AIS (Automated Indicator Sharing)
    b. STIX
    c. TAXII
    d. IOC
    Answer: a. AIS (Automated Indicator Sharing)itexamanswers​
21. Cisco Talos primarily focuses on:
    a. Providing actionable threat intelligence
    b. Conducting system backups
    c. Training AI models
    d. Monitoring DNS configurations
    Answer: a. Providing actionable threat intelligenceitexamanswers​
22. FireEye’s threat detection relies on:
    a. Signature-less behavioral analysis
    b. Log correlation only
    c. Static code analysis
    d. Domain whitelisting
    Answer: a. Signature-less behavioral analysisitexamanswers​
23. Which organization issues Common Vulnerabilities and Exposures (CVE) identifiers?
    a. MITRE
    b. SANS
    c. NIST
    d. DHS
    Answer: a. MITREitexamanswers​
24. Which type of threat intelligence is highly detailed and meant for SOC analysts?
    a. Tactical intelligence
    b. Strategic intelligence
    c. Political intelligence
    d. Personal intelligence
    Answer: a. Tactical intelligencecrowdstrike+1​
25. Open Source Threat Intelligence feeds are often praised for being:
    a. Cost-free and community-driven
    b. Proprietary and encrypted
    c. Confidential and restricted
    d. Legally protected only
    Answer: a. Cost-free and community-drivenanomali​
26. Commercial threat intelligence sources are valued because they:
    a. Offer contextual and real-time insights
    b. Are unverified and outdated
    c. Focus on social media rumors
    d. Operate purely offline
    Answer: a. Offer contextual and real-time insightsanomali​
27. Community intelligence is typically derived from:
    a. Shared collaboration among industry peers
    b. Academic research exclusively
    c. Machine-only log analysis
    d. Encrypted channels only
    Answer: a. Shared collaboration among industry peersanomali​
28. Threat intelligence feeds generally provide:
    a. Indicators of Compromise (IoCs)
    b. Financial rates
    c. Employee data
    d. Software licenses
    Answer: a. Indicators of Compromise (IoCs)cloudflare​
29. The purpose of CTI (Cyber Threat Intelligence) is to:
    a. Predict, identify, and mitigate cyber threats
    b. Manage payroll systems
    c. Configure routers
    d. Encrypt user data only
    Answer: a. Predict, identify, and mitigate cyber threatsbitsight​
30. OSINT includes monitoring of:
    a. Dark web and social media forums
    b. Encrypted internal databases
    c. Proprietary government code
    d. Air-gapped networks only
    Answer: a. Dark web and social media forumsanomali​
31. Which type of CTI usually uses IoCs such as URLs, domains, and file hashes?
    a. Technical
    b. Strategic
    c. Legal
    d. Personal
    Answer: a. Technicalexabeam+1​
32. Strategic intelligence is commonly consumed by:
    a. Executives and decision-makers
    b. SOC analysts
    c. Red team engineers
    d. Database administrators
    Answer: a. Executives and decision-makersexabeam​
33. Operational intelligence helps identify:
    a. Specific adversary campaigns and timelines
    b. Software license expirations
    c. Network speeds
    d. Email spam metrics
    Answer: a. Specific adversary campaigns and timelinesexabeam​
34. Threat Intelligence Feeds deliver data in formats like:
    a. JSON, STIX, and CSV
    b. DOCX and PDF
    c. XLSX only
    d. Image formats
    Answer: a. JSON, STIX, and CSVwiz​
35. Which intelligence sharing protocol is commonly paired with STIX?
    a. TAXII
    b. SNMP
    c. HTTPS
    d. FTP
    Answer: a. TAXIIitexamanswers​
36. Spamhaus DBL stands for:
    a. Domain Block List
    b. Data Breach List
    c. DNS Balance List
    d. Distributed Base List
    Answer: a. Domain Block Listwiz​
37. Threat intelligence enables organizations to:
    a. Anticipate and prevent attacks
    b. Increase system latency
    c. Disable firewalls
    d. Delay updates
    Answer: a. Anticipate and prevent attackscrowdstrike​
38. Tactical intelligence aids in:
    a. Mapping tools and TTPs of attackers
    b. Running server updates
    c. Encrypting files
    d. Managing licenses
    Answer: a. Mapping tools and TTPs of attackersexabeam​
39. Operational intelligence often answers:
    a. “Who is attacking and why?”
    b. “How much storage is left?”
    c. “When was the backup taken?”
    d. “Which software is uninstalled?”
    Answer: a. “Who is attacking and why?”exabeam​
40. Strategic CTI aligns with:
    a. Long-term risk management and policy planning
    b. Temporary code debugging
    c. Password rotation schedules
    d. Patch testing
    Answer: a. Long-term risk management and policy planningexabeam​
41. A major difference between OSINT and commercial threat intelligence is:
    a. OSINT is free; commercial is paid and proprietary
    b. Both are equally restricted
    c. OSINT is offline only
    d. Commercial feeds lack analysis
    Answer: a. OSINT is free; commercial is paid and proprietaryanomali​
42. IOC stands for:
    a. Indicator of Compromise
    b. Internal Operation Control
    c. Incident of Cybercrime
    d. Input Output Channel
    Answer: a. Indicator of Compromiseitexamanswers​
43. SecurityScorecard and Recorded Future distribute:
    a. Commercial intelligence feeds
    b. Free training videos
    c. System update alerts
    d. Cloud configuration guides
    Answer: a. Commercial intelligence feedssecurityscorecard+1​
44. The main goal of threat intelligence sharing communities is to:
    a. Improve collective cybersecurity posture
    b. Market products
    c. Manage accounting data
    d. Audit internal employees
    Answer: a. Improve collective cybersecurity posturerecordedfuture+1​
45. Threat intelligence helps SOC teams:
    a. Prioritize incident response
    b. Draw network diagrams
    c. Write encryption algorithms
    d. Update hardware drivers
    Answer: a. Prioritize incident responsecrowdstrike​
46. CTI feeds from government agencies like MS-ISAC primarily provide:
    a. Real-time indicators and alerts
    b. Password cracking tools
    c. Source code reviews
    d. Financial audits
    Answer: a. Real-time indicators and alertscisecurity​
47. Threat intelligence adds value to SIEM systems by:
    a. Correlating external threat data with internal events
    b. Encrypting stored logs
    c. Deleting historical incidents
    d. Isolating databases offline
    Answer: a. Correlating external threat data with internal eventsbitsight​
48. The primary output of commercial threat hunters’ operations is:
    a. High-confidence intelligence reports
    b. Network routing maps
    c. Cloud cost comparisons
    d. Log retention policies
    Answer: a. High-confidence intelligence reportsanomali​
49. Which CTI type involves human-driven context about adversary motivations and capabilities?
    a. Operational
    b. Technical
    c. Tactical
    d. Strategic
    Answer: a. Operationalexabeam​
50. An essential advantage of community intelligence is:
    a. Rapid sharing and real-time collaboration
    b. Closed vendor dependency
    c. Legal restrictions on feeds
    d. Static offline reports
    Answer: a. Rapid sharing and real-time collaborationanomali​

1. https://www.exabeam.com/explainers/cyber-threat-intelligence/4-types-of-cyber-threat-intelligence-and-using-them-effectively/
2. https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/
3. https://www.paloaltonetworks.com/cyberpedia/types-of-cyberthreat-intelligence
4. https://www.anomali.com/blog/threat-intelligence-sources
5. https://itexamanswers.net/3-3-2-threat-intelligence-quiz-answers.html
6. https://www.wiz.io/academy/must-follow-threat-intel-feeds
7. https://www.anomali.com/blog/open-source-threat-intelligence-feeds
8. https://www.cloudflare.com/learning/security/glossary/threat-intelligence-feed/
9. https://www.bitsight.com/learn/cti/cyber-threat-intelligence-feeds
10. https://securityscorecard.com/platform/intelligence-feeds/
11. https://www.recordedfuture.com/threat-intelligence-101/intelligence-sources-collection/threat-intelligence-sources
12. https://www.cisecurity.org/ms-isac/services/real-time-indicator-feeds
13. https://www.sanfoundry.com/1000-cyber-security-questions-answers/
14. https://www.igmguru.com/blog/cyber-security-mcqs
15. https://www.theknowledgeacademy.com/blog/cyber-security-mcq-and-answers/
16. https://www.interviewbit.com/cyber-security-mcq/
17. https://www.exabeam.com/explainers/cyber-threat-intelligence/best-threat-intelligence-providers-6-solutions-to-know/
18. https://interviewkickstart.com/blogs/articles/cyber-security-mcqs-answers
19. https://github.com/hslatman/awesome-threat-intelligence
20. https://www.bluevoyant.com/knowledge-center/threat-intelligence-tools-types-benefits-and-best-practices