ECCouncil 312-85 Exam Questions : Certified Threat Intelligence Analyst

ABC is a well-established cyber-security company in the United States. The organization implemented the automation of tasks such as data enrichment and indicator aggregation. They also joined various communities to increase their knowledge about the emerging threats. However, the security teams can only detect and prevent identified threats in a reactive approach.
Based on threat intelligence maturity model, identify the level of ABC to know the stage at which the organization stands with its security and vulnerabilities.

• A. Level 3: CTI program in place
• B. Level 2: increasing CTI capabilities
• C. Level 1: preparing for CTI
• D. Level 0: vague where to start

Organizations must choose the right threat intelligence platform to assess and leverage intelligence information, monitor multiple enforcement points, manage intelligence feeds, and select appropriate security for digital assets.
Which of the following key factors ensures that the threat intelligence platform offers a structured way to perform investigations on attacks by processing the threat intelligence and utilizing internal security controls to automate the detection process?

• A. Search
• B. Workflow
• C. Open
• D. Scoring

In which of the following forms of bulk data collection are large amounts of data first collected from multiple sources in multiple formats and then processed to achieve threat intelligence?

• A. Structured form
• B. Production form
• C. Unstructured form
• D. Hybrid form

Enrage Tech Company hired Enrique, a security analyst, for performing threat intelligence analysis. While performing data collection process, he used a counterintelligence mechanism where a recursive DNS server is employed to perform interserver DNS communication and when a request is generated from any name server to the recursive DNS server, the recursive DNS servers log the responses that are received. Then it replicates the logged data and stores the data in the central database. Using these logs, he analyzed the malicious attempts that took place over DNS infrastructure.
Which of the following cyber counterintelligence (CCI) gathering technique has Enrique used for data collection?

• A. Data collection through DNS zone transfer
• B. Data collection through DNS interrogation
• C. Data collection through passive DNS monitoring
• D. Data collection through dynamic DNS (DDNS)

Karry, a threat analyst at an XYZ organization, is performing threat intelligence analysis. During the data collection phase, he used a data collection method that involves no participants and is purely based on analysis and observation of activities and processes going on within the local boundaries of the organization.
Identify the type of data collection method used by Karry.

• A. Exploited data collection
• B. Passive data collection
• C. Active data collection
• D. Raw data collection