CREST Practitioner Threat Intelligence Analyst Sample Questions:

1. Which of the following characteristics of APT refers to numerous attempts done by the attacker to gain entry to the target's network?

A) Multiphased
B) Risk tolerance
C) Timeliness
D) Attack origination points

2. A threat analyst obtains an intelligence related to a threat, where the data is sent in the form of a connection request from a remote host to the server. From this data, he obtains only the IP address of the source and destination but no contextual information. While processing this data, he obtains contextual information stating that multiple connection requests from different geo-locations are received by the server within a short time span, and as a result, the server is stressed and gradually its performance has reduced. He further performed analysis on the information based on the past and present experience and concludes the attack experienced by the client organization.
Which of the following attacks is performed on the client organization?

A) Bandwidth attack
B) Distributed Denial-of-Service (DDoS) attack
C) MAC spoofing attack
D) DHCP attacks

3. Robert is an incident handler working for Xsecurity Inc. One day, his organization faced a massive cyberattack and all the websites related to the organization went offline. Robert was on duty during the incident and he was responsible to handle the incident and maintain business continuity. He immediately restored the web application service with the help of the existing backups.
According to the scenario, which of the following stages of incident handling and response (IH&R) process does Robert performed?

A) Eradication
B) Notification
C) Evidence gathering and forensics analysis
D) Recovery

4. Which of the following is not a countermeasure to eradicate cloud security incidents?

A) Disable security options such as two factor authentication and CAPTCHA
B) Patch the database vulnerabilities and improve the isolation mechanism
C) Check for data protection at both design and runtime
D) Remove the malware files and traces from the affected components

5. Which one of the following is the correct flow of the stages in an incident handling and response (IH&R) process?

A) Incident recording -> Preparation -> Containment * Incident triage -> Recovery > Eradication -> Post- incident activities
B) Containment -* Incident recording -* Incident triage -> Preparation -* Recovery -> Eradication -* Post-incident activities
C) Preparation -* Incident recording -> Incident triage -* Containment -*#Eradication->Recovery-
* Post-incident activities
D) Incident triage -> Eradication -#Containment-* Incident recording-* Preparation-* Recovery-
* Post-incident activities

Solutions: