Threat Intelligence -- Quiz

Question 1 of 6

A security analyst is building a threat profile of a suspected nation-state threat actor group. She reviews public congressional hearing transcripts, downloads reports from a national cybersecurity agency's website, and scans security researcher blogs for published analysis of the group's campaigns. All sources are freely accessible without payment or authorization. Which category of intelligence is she using?

Proprietary intelligence — government agency reports are classified and require vendor access to obtain Open-Source Intelligence (OSINT) — all sources are publicly available to anyone without special authorization Dark web intelligence — threat actor profiles are only found on specialized overlay networks Information-sharing organization intelligence — the analyst is using a structured sharing platform to collect data

Question 2 of 6

A financial services firm's security team subscribes to a threat intelligence service. The service notifies them on a Thursday that a ransomware campaign has been spreading through the banking sector since Tuesday — before any of the firm's systems were affected — and provides specific indicators of compromise, affected infrastructure, and detection rules. No government advisory has yet been published and no public forum post exists about the campaign. What capability of the threat intelligence service made this advance warning possible?

Dark web monitoring — the service detected the ransomware group discussing the campaign on hidden forums two days before it launched Government classification access — the service has special clearance to receive classified threat advisories before public release Cross-organization correlation — the service detected the campaign at another client organization on Tuesday and distributed the derived indicators to all subscribers before it reached the firm OSINT aggregation — the service combined multiple public sources faster than the firm's own research team could

Question 3 of 6

An organization joins the Cyber Threat Alliance. After joining, they submit intelligence about a phishing campaign that targeted them. Another member questions the reliability of the submission. What process does the CTA use to address reliability concerns and ensure distributed intelligence is trustworthy?

The CTA distributes all submissions immediately without review, leaving reliability assessment to each member organization The CTA validates each submission, cross-references it against other submissions for corroboration, assigns a credibility and severity score, and only distributes validated intelligence to members The CTA requires each submission to be independently verified by at least three other member organizations before any intelligence is distributed The CTA uses a government review board to classify submissions by sensitivity level before releasing them to the private sector

Question 4 of 6

A security researcher wants to access a dark web forum used by a criminal hacking group to monitor for mentions of client organizations. She opens her standard web browser and types the forum's address. The page does not load. What is the most likely reason, and what does she actually need?

The forum requires a VPN connection; she should connect to a commercial VPN service and retry with her standard browser Dark web content requires specialized software and specific configurations to access — it is an overlay network not reachable through standard browsers; she needs tools like the Tor browser that route through encrypted anonymizing relays The forum blocks commercial ISPs; she needs to access it from a government network that has special routing agreements The forum address is incorrect; dark web forums are actually indexed by search engines under specialized category filters

Question 5 of 6

A security analyst finds a post on a public security forum claiming that a specific IP address block is being used by a threat actor group targeting financial institutions. The post is detailed and includes what appear to be technical indicators. Before taking any blocking action, what is the correct next step, and why?

Block the IP range immediately — a detailed post with technical indicators provides sufficient confidence for immediate action, and speed is critical when threat actors are actively targeting the sector Report the post to the government cybersecurity agency for official validation before the analyst's organization takes any internal action Validate the claim against additional corroborating sources before acting — OSINT quality varies, posts may be inaccurate or deliberate disinformation, and unverified blocking could disrupt legitimate traffic Discard the finding entirely — public forum posts should never be used as a source for security decisions regardless of technical detail

Question 6 of 6

A security operations team is deciding which threat intelligence sources to monitor for their organization's specific situation. They have been targeted by a financially motivated criminal group that is known to post proof-of-compromise screenshots on underground forums and list stolen credentials for sale before using them for further access. Which intelligence source most directly addresses the need for early warning about this specific threat behavior?

Government advisories — national cybersecurity agencies publish detailed threat actor profiles including their sale and posting behavior Dark web monitoring — specifically monitoring the forums and marketplaces where the group is known to post and sell gives direct visibility into their activity before they use acquired access or data OSINT from public security blogs — researchers track these groups and publish detailed analysis of their posting patterns CTA membership — submitting the group's indicators to the CTA will cause other members to monitor the group on the organization's behalf

Matching

ndash;10. Match each threat intelligence scenario to the source type it best represents.

1. A security researcher uses national cybersecurity agency advisories, public congressional hearing transcripts, and security researcher blogs to build a profile of a threat actor group — all without paying for any service or accessing any restricted system.

2. A company subscribes to a service that aggregates threat data from thousands of global sensors, honeypots, and incident response engagements. When a new attack campaign targets one subscriber, the service analyzes it and automatically pushes indicators and blocking rules to all other subscribers within hours — before the campaign reaches them.

3. After responding to a zero-day exploit, a cybersecurity firm submits structured, standardized threat data to an industry collaboration group. The group validates the submission, scores it as Critical severity, and makes it available to all member organizations to integrate into their defenses within 24 hours of the original attack.

4. A monitoring service alerts a healthcare organization that 340 employee email addresses and passwords matching the organization's domain have appeared in a credential listing on an underground marketplace accessible only through specialized anonymizing software — and that the same marketplace includes a forum post referencing the organization's name as a planned target.

1. 2. 3. 4.

A. OSINT

B. Proprietary / commercial intelligence

C. Cyber Threat Alliance (CTA)

D. Dark web intelligence

Threat Intelligence — Quiz

Matching