A. Hypotheses
B. Patterns
C. Models
D. Data sets
A. Develop hypotheses
B. Adjust the current plan
C. Collect more data
D. Celebrate successes
A. They slow down the process
B. They are not relevant
C. They provide valuable information on potential threats
D. They only work for specific types of threats
A. To lock down access to critical systems
B. To establish a point of reference for normal network activity
C. To only focus on external threats
D. To ignore any suspicious behavior detected
A. Intrusion detection
B. Attack surface analysis
C. Patch management
D. Vulnerability scanning
A. Analyzing network traffic
B. Identifying potential threat indicators
C. Understanding the organization's environment and assets
D. Defending against known attacks
A. Real-time monitoring of network traffic
B. Information about current and emerging threats
C. Predictive analysis of potential cyber threats
D. Data collected from previous security incidents
A. To encrypt data at rest and in transit
B. To hide critical assets from potential attackers
C. To isolate malicious files and observe their behavior
D. To establish secure communication channels for threat intelligence
A. Threat intelligence analysis
B. Signature-based detection
C. Machine learning
D. Behavioral analysis
A. By outsourcing threat hunting to third-party vendors
B. By ignoring potential threats to focus on more pressing issues
C. By relying solely on external security measures like firewalls and antivirus software
D. By proactively detecting and responding to threats before they escalate
B. Deception techniques
C. Signature-based detection
A. Hashing algorithms
B. IoC scanning
C. Geolocation tracking
D. NetFlow analysis
A. Disconnected SIEM and endpoint detection and response (EDR) platforms
B. Uncoordinated firewall and intrusion prevention systems
C. SIEM, EDR, and threat intelligence platforms
D. Standalone antivirus solutions
A. By providing insights into the threat actor's methods and behaviors
B. By identifying potential future targets
C. By preventing all types of cyber attacks
D. By launching offensive cyber operations
A. By increasing the number of false positives
B. By ignoring all potential threats
C. By identifying and neutralizing advanced threats
D. By slowing down network operations
A. Because it relies on known IOCs
B. Because it detects deviations from normal behavior
C. Because it requires a response from the SOC
D. Because it only reacts to identified threats
A. Decreased collaboration with security teams
B. Weakened security defenses
C. Improved resilience to cyberattacks
D. Reduced number of security controls
A. To identify potential threats
B. To test the hypothesis for accuracy
C. To confirm existing threat intelligence
D. To determine the effectiveness of deployed security tools
A. Threat response
B. Hypothesis generation
C. Threat confirmation
D. Data analysis