Cyber Security Quiz: Threat Intelligence
10 questions · exam conditions
0:00
Threat IntelligenceQuestion 1 of 10

A high-confidence intelligence report associates an IP address with a threat group. The address belongs to a major cloud provider and was observed hosting command-and-control infrastructure for six hours. A proxy search shows that one employee connected to the address during that period.

What is the MOST defensible conclusion from the available intelligence?

The employee's system was compromised by the named group because the connection occurred during the reported period.
The cloud provider participated in the campaign because its address hosted command-and-control infrastructure.
The connection merits investigation, but the shared IP match alone does not establish compromise or attribution.
The connection can be dismissed because IP addresses operated by cloud providers cannot function as reliable IOCs.
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Threat Intelligence

Practice Threat Intelligence in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Threat Intelligence, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A high-confidence intelligence report associates an IP address with a threat group. The address belongs to a major cloud provider and was observed hosting command-and-control infrastructure for six hours. A proxy search shows that one employee connected to the address during that period.

What is the MOST defensible conclusion from the available intelligence?

  1. The employee's system was compromised by the named group because the connection occurred during the reported period.
  2. The cloud provider participated in the campaign because its address hosted command-and-control infrastructure.
  3. The connection merits investigation, but the shared IP match alone does not establish compromise or attribution. (correct answer)
  4. The connection can be dismissed because IP addresses operated by cloud providers cannot function as reliable IOCs.
Explanation: When working through threat intelligence questions, ask yourself: what does this evidence actually prove, versus what does it merely suggest? Cyber investigations live or die on that distinction. Here, you have a time-correlated IP match between a known C2 address and an employee connection. That sounds alarming — but notice the critical qualifiers. The IP belongs to a shared cloud infrastructure, meaning dozens or hundreds of tenants may use the same address at any given time. A six-hour hosting window and a single proxy log entry create a correlation, not a causal chain. The correct answer, C, reflects the analyst's proper posture: treat this as a lead requiring investigation, but resist letting confirmation bias drive you to an attribution conclusion the evidence doesn't support. Good intelligence tradecraft demands you distinguish between an indicator and proof. A is the classic correlation-equals-causation trap. A connection during the reported window is consistent with compromise, but also consistent with coincidence, a shared CDN, or a legitimate SaaS tool hosted on the same IP block. Asserting compromise without forensic evidence on the endpoint is unjustifiable. B commits an attribution error in the opposite direction — concluding the cloud provider was complicit. Hosting malicious infrastructure (often unknowingly) is entirely different from participating in a campaign. D goes too far the other way. Cloud IP addresses can function as IOCs; they simply require additional context and corroboration. Dismissing the indicator entirely abandons due diligence. Your takeaway: on threat intelligence questions, watch for answers that leap from indicator to conclusion. The defensible position almost always acknowledges the signal while demanding further evidence before attribution.

Question 2

A threat actor rotates IP addresses daily and recompiles its malware for each target. Across incidents, it consistently uses WMI to create remote processes from a compromised administrator workstation. The detection team can implement only one new analytic this sprint.

Which analytic would likely impose the greatest detection challenge on this actor while retaining value across campaigns?

  1. Match the current command-and-control IP addresses against outbound firewall logs.
  2. Match the latest malware hashes against files collected from administrator workstations.
  3. Detect any outbound traffic originating from the administrator workstation subnet.
  4. Detect unusual remote WMI process creation correlated with administrator workstation activity. (correct answer)
Explanation: When evaluating detection strategies against a sophisticated threat actor, think in terms of the Pyramid of Pain — a framework describing how difficult it is for an adversary to change different indicators. At the bottom sit easily-changed indicators like IP addresses and file hashes; at the top sit behaviors and TTPs (Tactics, Techniques, and Procedures), which are expensive and time-consuming for attackers to abandon. The scenario tells you everything you need: this actor rotates IPs daily and recompiles malware per target — meaning they've already automated their way around low-level indicators. But they consistently use WMI for remote process creation from compromised admin workstations. That consistency is their fingerprint. Answer D targets exactly this behavioral pattern, and because WMI-based lateral movement is a deliberate operational choice deeply embedded in their workflow, changing it would require significant retooling. This analytic also generalizes across future campaigns involving the same actor. Answer A fails because IP-based blocking is trivially bypassed — the actor literally rotates addresses daily, so any match becomes stale within 24 hours. Answer B has the same fundamental weakness: recompiling malware changes the hash entirely, making hash-matching an exercise in always chasing yesterday's sample. Answer C casts an overly broad net — flagging all outbound traffic from the admin subnet would generate enormous false-positive noise, quickly overwhelming the detection team and eroding the analytic's practical value. As a study strategy: whenever a question describes an actor who changes low-level artifacts but repeats behaviors, the right detection answer will almost always target TTPs rather than IPs, hashes, or domains. Behavior-based analytics age slowly; indicator-based analytics expire fast.

Question 3

Investigators observe a spear-phishing attachment, macro-based execution, credential dumping, and remote service creation. An intelligence report states that Group X commonly uses the same sequence, but the report also notes that several unrelated groups use each of these techniques.

How should the observed TTP overlap affect attribution?

  1. It proves Group X conducted the intrusion because the complete sequence is more reliable than any IOC.
  2. It supports Group X as a hypothesis, but attribution still requires corroborating and discriminating evidence. (correct answer)
  3. It excludes Group X because techniques shared by multiple actors have no intelligence value.
  4. It identifies the malware family but cannot contribute to any assessment of the responsible actor.
Explanation: When you see attribution questions on the cyber-security exam, think carefully about the difference between supporting a hypothesis and proving one. Intelligence analysis — especially TTP-based attribution — is probabilistic, not binary. The scenario gives you a technique sequence that matches Group X, but explicitly tells you multiple unrelated groups use the same individual techniques. This is the critical tension. A shared behavioral pattern increases the plausibility of Group X as the responsible actor — sequences are harder to coincidentally replicate than single techniques — but it does not eliminate other candidates who exhibit the same tradecraft. Sound attribution requires corroborating evidence (infrastructure overlaps, victimology, malware artifacts) and discriminating evidence that distinguishes Group X from those other actors. That's exactly what B captures: the overlap supports Group X as a hypothesis while acknowledging the analysis isn't complete. A is wrong because it overclaims. Even a complete TTP sequence shared by multiple groups cannot prove attribution — it raises confidence but doesn't exclude alternatives. Treating behavioral overlap as definitive is a classic analytic trap called confirmation bias. C goes too far in the opposite direction: techniques shared across groups still carry intelligence value as part of a broader analytic picture; they just can't stand alone. D is a non-sequitur — TTP analysis does inform actor assessment, even imperfectly, and the scenario never mentions malware family identification as the primary output. For exam strategy, watch for answer choices that use absolute language like "proves" or "excludes." In intelligence analysis, almost nothing is absolute — strong evidence narrows the hypothesis space; it rarely collapses it to a single actor.

Question 4

Malware recovered during an incident has a unique SHA-256 hash. Analysis also shows that the malware dumps credentials from LSASS and then uses remote service creation for lateral movement. The organization wants to help peer companies detect both the recovered sample and likely future variants.

Which intelligence-sharing approach BEST meets the organization's objective?

  1. Share only the hash because it uniquely identifies the malicious family and its future variants.
  2. Share only the malware family name because endpoint tools interpret family names consistently.
  3. Share the hash as a sample IOC and the credential-access and lateral-movement TTPs with context. (correct answer)
  4. Share only the affected hostnames because internal asset names provide the most precise detection logic.
Explanation: When sharing threat intelligence, the goal isn't just identifying one specific attack — it's enabling others to detect the behavior behind the attack, including future variants. This is where the Pyramid of Pain and the MITRE ATT&CK framework become essential mental tools. Indicators low on the pyramid (like hashes) are trivial for attackers to change; behaviors and TTPs (Tactics, Techniques, and Procedures) are much harder to evade. Answer C is correct because it combines both layers of intelligence strategically. The SHA-256 hash gives peer organizations a precise, actionable IOC to immediately detect the exact recovered sample. The TTPs — credential access via LSASS dumping and lateral movement via remote service creation — describe how the attacker operates, enabling detection of future variants even after the attacker rotates their tooling. This dual approach directly satisfies the organization's dual objective. Answer A fails because a unique hash identifies only that one binary. A trivial recompile or obfuscation produces a new hash, instantly defeating hash-only detection. Hashes are brittle indicators. Answer B is worse — malware family names are inconsistently classified across vendors and provide no concrete detection logic for tools or analysts. Sharing a name without behavioral context is practically useless for active defense. Answer D is the weakest option: internal hostnames are environment-specific artifacts. They mean nothing to peer organizations with entirely different infrastructure and provide zero generalizable detection value. Your study tip: on threat intelligence questions, always ask yourself "Does this indicator survive if the attacker changes one thing?" If not, you need TTPs alongside it. Hash + behavior beats hash alone every time.

Question 5

An incident report includes the exact command powershell.exe -EncodedCommand JAB... and states that the adversary uses command and scripting interpreters to execute obfuscated code.

Which classification of the report's information is MOST accurate?

  1. Both items are TTPs because every command line describes an adversary's operating method.
  2. The exact command is an IOC-like artifact, while interpreter-based execution is a TTP. (correct answer)
  3. The exact command is a TTP, while interpreter-based execution is a network IOC.
  4. Both items are IOCs because all observed malicious activity can be matched in telemetry.
Explanation: When analyzing incident report data, you need to distinguish between Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) — two layers of the threat intelligence pyramid that serve very different purposes. IOCs are specific, observable artifacts: exact file hashes, IP addresses, domain names, or in this case, a precise command string like powershell.exe -EncodedCommand JAB.... They're concrete evidence left behind by an attacker — highly specific but also highly perishable, since adversaries change them easily. TTPs, by contrast, describe how an adversary operates at a behavioral level — their methods, patterns, and techniques. "Using PowerShell to execute base64-encoded commands" is a technique that persists across many campaigns regardless of the exact string used. Answer B is correct because it correctly separates these two layers. The exact command powershell.exe -EncodedCommand JAB... is an IOC-like artifact — a specific, matchable string in your telemetry. The broader behavior — using command and scripting interpreters to run obfuscated code — maps directly to a TTP (MITRE ATT&CK T1059, for reference). Answer A fails because not every command line qualifies as a TTP. The specific string is an artifact, not a behavioral pattern. Answer C inverts the classification entirely — calling the command a TTP and interpreter-based execution a "network IOC" is backwards on both counts. Answer D is too broad; lumping everything observable into "IOC" ignores the meaningful distinction between artifacts and behaviors. Your study tip: remember that TTPs survive adversary retooling — they change tools, not habits. If something could be swapped out tomorrow and the attack still works the same way, it's a TTP.

Question 6

An intelligence platform contains a domain marked malicious after it served a payload eight months ago. The registration has since expired, and an unrelated company has acquired the domain for legitimate use. Historical incident records still refer to the original observation.

How should the organization MOST appropriately manage this indicator?

  1. Keep blocking it permanently because a confirmed IOC remains malicious regardless of later ownership.
  2. Delete it from all records so historical searches cannot generate false-positive results.
  3. Mark it as expired or revoked for current enforcement while preserving its historical context. (correct answer)
  4. Convert it into a TTP because reassigned domains no longer qualify as infrastructure indicators.
Explanation: When managing threat intelligence, you must balance two competing needs: keeping historical records accurate for forensic and audit purposes, and avoiding enforcement actions that would harm innocent parties. This question tests your understanding of indicator lifecycle management — specifically what to do when an IOC's context changes dramatically after initial observation. The right approach, reflected in C, is to mark the indicator as expired or revoked so it no longer triggers active blocks or alerts, while leaving the historical record intact. That original observation was legitimate — a payload was served from that domain. Analysts reviewing past incidents need that context. Wiping or ignoring it would corrupt your organization's threat history and undermine future investigations. A is a classic trap: treating IOCs as permanently immutable. Indicators have lifecycles. A domain that changed hands isn't the same threat it once was, and continuing to block it means disrupting a legitimate business — a real-world consequence with potential legal and operational implications. B goes too far in the opposite direction. Deleting historical records destroys forensic value and violates most data governance and incident response best practices. The goal isn't to erase the past; it's to contextualize it properly for present use. D misunderstands the MITRE ATT&CK framework. Tactics, Techniques, and Procedures (TTPs) describe how adversaries behave, not what infrastructure they used. A reassigned domain doesn't become a TTP — those are behavioral patterns, not repurposed artifacts. As a study tip, whenever you see a question about indicator management, ask yourself: does this change affect current enforcement, historical validity, or both? Most lifecycle decisions require preserving the past while updating present applicability — not all-or-nothing actions.

Question 7

After a suspected intrusion, an analyst scans all endpoints for every hash, filename, and domain in a reputable intelligence report. No matches are found. The report states that the actor uses polymorphic payloads and frequently changes infrastructure but often performs browser credential theft.

What is the BEST interpretation of the negative scan results?

  1. They rule out the actor because a reputable report's IOC set is sufficient for exclusion.
  2. They confirm successful remediation because current endpoints contain none of the listed indicators.
  3. They prove the report is inaccurate because valid IOCs must match every intrusion by that actor.
  4. They lower confidence in exact reported artifacts but do not rule out variants using the same TTPs. (correct answer)
Explanation: When analyzing threat intelligence, you need to distinguish between indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs). IOCs — hashes, domains, filenames — are low-level, brittle artifacts that change constantly. TTPs describe how an adversary operates and are far more durable. This question tests whether you understand that absence of IOC matches is not the same as absence of the threat. D is correct because the report itself tells you why a negative scan means little: the actor uses polymorphic payloads (meaning file hashes mutate) and rotates infrastructure (meaning domains change). These traits are specifically designed to evade IOC-based detection. What the report also tells you is that browser credential theft is a consistent behavior — a TTP. So while you've lowered confidence in those exact artifacts appearing, the actor could still be present using new hashes, new domains, and the same behavioral pattern. A is dangerously wrong — it assumes a reputable source's IOC list is comprehensive and definitive enough to exclude an actor. IOC lists are snapshots, not exhaustive fingerprints. B confuses absence of evidence with evidence of absence; finding no IOCs doesn't confirm remediation, it may just mean the actor evolved. C is logically flawed — it demands that every intrusion by an actor match every IOC in a report, which misunderstands how threat intelligence works. IOCs vary per campaign by design. A useful mental anchor: IOCs expire, TTPs endure. On exam questions involving sophisticated actors and negative scan results, always ask whether the behavior — not just the artifact — has been ruled out.

Question 8

A SOC receives two intelligence items about the same campaign. Item 1 is a fresh domain observed in command-and-control traffic, with high confidence and an expected lifetime of several days. Item 2 describes a medium-confidence pattern in which the actor uses archive files followed by DLL side-loading. The SOC needs immediate containment and a hunt for infections that may use different infrastructure.

Which response BEST uses both intelligence items according to their strengths?

  1. Temporarily block the domain for rapid containment and hunt for the archive-to-side-loading behavior across endpoint telemetry, validating matches before concluding compromise. (correct answer)
  2. Permanently block the domain across all egress points and treat every archive file on the network as definitive proof of actor compromise requiring immediate isolation.
  3. Ignore the domain entirely because infrastructure IOCs are too short-lived to be actionable, and directly attribute every DLL side-loading event to the reported actor.
  4. Hunt only for the domain across DNS and proxy logs, because medium-confidence TTP reporting introduces too much uncertainty to support any defensive analysis or hunting activity.
Explanation: When you see a question pairing a high-confidence infrastructure indicator with a medium-confidence behavioral pattern, think about the intelligence pyramid: atomic indicators (like domains) are fast and precise but fleeting, while TTPs (like attack sequences) are durable but noisier. The optimal response uses each type according to its nature — act quickly on the domain, hunt carefully with the behavioral pattern. Answer A is correct because it respects both signals appropriately. The fresh domain gets a temporary block — fast containment that matches its short expected lifetime without over-committing to an indicator that will likely rotate soon. The archive-to-DLL-side-loading pattern drives a hunt across endpoint telemetry, but matches are validated before declaring compromise, which is exactly right for medium-confidence intelligence. This approach balances speed with analytical rigor. Answer B fails on two fronts: making the block permanent misaligns with the domain's brief lifespan, and treating every archive file as "definitive proof" ignores the medium-confidence caveat entirely. Archive files are ubiquitous — that logic would flood the SOC with false positives. Answer C makes the opposite error. Dismissing the domain because IOCs are short-lived wastes a high-confidence, immediately actionable indicator. Simultaneously attributing every DLL side-loading event directly to the actor ignores the uncertainty baked into medium-confidence reporting. Answer D discards the behavioral intelligence altogether, which squanders the hunt opportunity the scenario explicitly requires. Medium confidence doesn't mean "useless" — it means "validate before concluding." A good study rule: match your response intensity and permanence to both the confidence level and the expected lifetime of each intelligence item.

Question 9

A workstation repeatedly attempts to connect to a domain listed in a threat feed. Before the attempts occurred, law enforcement seized the domain and redirected it to a monitored sinkhole. Endpoint telemetry shows no new payload execution during the connection attempts.

What does the domain match MOST strongly indicate?

  1. The workstation may contain software configured to beacon to the former malicious domain. (correct answer)
  2. The threat actor currently controls the workstation through the seized command server.
  3. The sinkhole infected the workstation when it accepted the outbound network connections.
  4. The IOC is necessarily a false positive because the domain is no longer actor-controlled.
Explanation: When you see a scenario involving threat intelligence feeds, sinkholes, and beaconing behavior, you're being tested on your understanding of how malware persistence and C2 (command-and-control) communication work — even after the attacker's infrastructure is disrupted. Malware installed on a host is typically hardcoded or configured with specific domains or IPs to "beacon" home at regular intervals, requesting instructions or exfiltrating data. When law enforcement seizes and sinkhole a domain, the malware on infected endpoints doesn't know the infrastructure changed — it keeps trying to reach the same address. That's exactly what's happening here. The repeated outbound connection attempts to the seized domain most strongly suggest the workstation has resident malware still trying to phone home. Answer A is correct because it accurately describes this beaconing behavior as evidence of a persistent, configured infection. Answer B is wrong because a sinkhole, by definition, is no longer actor-controlled — law enforcement redirected it. The threat actor cannot issue commands through a seized domain, so active control is impossible in this scenario. Answer C reverses causality entirely; sinkholes are passive monitoring infrastructure. They log inbound connections but do not push payloads to connecting hosts, and the passage explicitly confirms no new payload execution occurred. Answer D is the most dangerous distractor — the fact that a domain is seized doesn't make the IOC a false positive. The domain was malicious; the beaconing behavior is real evidence of compromise. "No longer actor-controlled" ≠ "no longer relevant." Your takeaway: on exam questions involving sinkholes, remember they detect infected hosts, not create them. Beaconing to a dead C2 domain is a classic sign of persistent malware, not a false positive.

Question 10

A threat actor replaces its payload hash and command-and-control domains after each campaign. Across three incidents, however, the initial payload consistently launches rundll32.exe, creates a scheduled task under a user-writable path, and executes again after logon.

Which detection strategy would be MOST resilient to the actor's observed changes?

  1. Alert on the known payload hashes and retain each hash indefinitely.
  2. Alert on the process, task-creation, and path relationships across endpoint events. (correct answer)
  3. Block newly registered domains that use the actor's previous domain registrar.
  4. Block outbound connections to the countries that hosted prior command infrastructure.
Explanation: When you see a question about detecting persistent threat actors, think about the Pyramid of Pain — the concept that different indicator types vary in how costly they are for an attacker to change. Hashes are trivially swapped, domains take minimal effort, but behaviors like specific process chains and persistence mechanisms require the attacker to fundamentally retool. That's exactly what this scenario illustrates. The actor changes hashes and domains between campaigns, but consistently uses rundll32.exe, creates a scheduled task in a user-writable path, and re-executes after logon. These behavioral patterns — process relationships, task-creation events, and suspicious path usage — remain stable because they reflect how the actor operates, not what they're using. Alerting on those relationships, as B describes, survives the actor's evasion techniques because you're detecting the technique itself, not a disposable artifact. A is wrong because hash-based detection is exactly what the attacker already defeats by rotating payloads. Retaining old hashes indefinitely adds storage cost with zero detection benefit against this actor's next campaign. C is a trap — blocking by registrar is extremely broad, would generate massive false positives, and the actor can simply switch registrars, which is far easier than changing their intrusion methodology. D similarly fails because geo-blocking by country is coarse, easy to evade by moving infrastructure, and would block legitimate traffic while missing the actor the moment they shift hosting locations. For the exam, remember: behavioral detections sit high on the Pyramid of Pain. Questions describing actors who rotate indicators but repeat techniques are specifically testing whether you prioritize TTPs over IOCs.