Sample questions
Bt Threat Intelligence ApplicationDifficulty 1
In basic threat intelligence terminology, what is an IOC (Indicator of Compromise)?
- aA written policy document that describes how an organization should respond to any incident.
- bA budget line item used to justify purchasing new detection and response tooling.
- cA formal certification that proves a system has never been compromised by an attacker.
- dAn observable artifact -- a file hash, IP, or domain -- tied to malicious activity.✓
Explanation:An IOC is a concrete, observable piece of evidence (a hash, an IP, a domain, a registry key, etc.) that has been seen in connection with malicious activity, and can be searched for or matched against telemetry.
Bt Threat Intelligence ApplicationDifficulty 1
How does a TTP (Tactics, Techniques, and Procedures) differ from a simple IOC like a file hash?
- aA TTP is always encrypted, while an IOC is always sent in plain text over the network.
- bA TTP describes the attacker's behavior pattern, while an IOC is a static artifact of one instance of it.✓
- cThere is no real difference; TTP is just another name analysts use for the same kind of hash-based indicator.
- dA TTP only applies to nation-state actors, while IOCs only apply to financially motivated criminal groups.
Explanation:A TTP captures a behavioral pattern (e.g., using a scheduled task for persistence), which tends to be reused across many campaigns, whereas an IOC like a hash is a single, easily changed artifact tied to one specific sample or infrastructure instance.
Bt Threat Intelligence ApplicationDifficulty 2
The Pyramid of Pain model ranks indicator types by how much difficulty they cause an attacker when defenders detect and act on them. According to this model, why are hash values considered 'easy' for an attacker to deal with, compared to TTPs?
- aAttackers are physically incapable of generating more than one hash per malware family.
- bHash values are legally protected information, so defenders cannot use them to block anything.
- cHash values never appear in any threat intelligence feed, so defenders rarely act on them at all.
- dAn attacker can trivially change a file's hash by recompiling it, at almost no cost.✓
Explanation:In the Pyramid of Pain, hashes sit at the bottom because they are trivial and cheap for an attacker to change (a single byte change alters the hash), while TTPs sit at the top because changing fundamental behavior requires significant retooling and cost.
Bt Threat Intelligence ApplicationDifficulty 1
What is the main purpose of MITRE ATT&CK's basic structure of 'tactics' and 'techniques'?
- aTactics represent the attacker's goal at a stage; techniques describe how to achieve it.✓
- bTactics describe legal frameworks for prosecuting attackers, and techniques describe court procedures.
- cTactics are only used for physical building security, and techniques are only used for network security.
- dTactics list specific malware family names, and techniques list the antivirus vendors that detect them.
Explanation:In MITRE ATT&CK, a tactic is the 'why' (the adversary's objective, such as persistence or lateral movement), and a technique is a specific 'how' that can achieve that objective, giving defenders a shared vocabulary to map observed behavior.
Bt Threat Intelligence ApplicationDifficulty 2
An analyst downloads a free, publicly available list of IP addresses labeled as 'malicious' from a community feed with no documented update or removal policy. What is the most important thing to check before using this feed for automatic blocking?
- aWhether the file is formatted in CSV or JSON, since automatic blocking only works with one specific format.
- bHow the feed handles aging and false positives, since IPs are reassigned often and stale entries can block traffic.✓
- cWhether the feed provider has a visually appealing website, since a professional site implies accurate data.
- dWhether the feed is written in the analyst's native language, since translation errors would otherwise make matching impossible.
Explanation:IP addresses churn quickly (cloud providers reassign them, shared hosting rotates tenants), so a feed without a clear aging/removal policy risks including stale entries that will cause false positives if used for automatic blocking without validation.
Bt Threat Intelligence ApplicationDifficulty 1
Which of the following best describes the difference between strategic, operational, and tactical threat intelligence?
- aStrategic intel informs leadership risk decisions, operational intel supports campaign planning, and tactical intel gives detail analysts use directly.✓
- bStrategic intel is only about stock market trends, operational intel is only about server uptime, and tactical intel is only about physical security guards.
- cThe three terms are interchangeable and any threat intelligence report can be labeled with any of the three names.
- dStrategic intel is always classified top secret, operational intel is always unclassified, and tactical intel does not exist in practice.
Explanation:These are commonly used tiers of intelligence: strategic intel targets executives and long-term risk posture, operational intel supports understanding of ongoing or upcoming campaigns/actor behavior, and tactical intel is the technical, immediately actionable detail (IOCs, TTPs) analysts use day to day.