Threat intelligence sources, indicators of compromise, and detection techniques tested on CompTIA CySA+.
40 cards · basic cards · AI-written, checked twice. Edit anything.
- What are the three main types of threat intelligence by time relevance?
Show answer
Strategic (long-term trends), tactical (current campaigns and techniques), operational (immediate threats and indicators)- Define indicator of compromise (IoC).
Show answer
Observable evidence of a security incident or attack, such as a malicious IP address, file hash, or domain name- What is OSINT in threat intelligence?
Show answer
Open-source intelligence; gathering data from publicly available sources like social media, news, forums, and public databases- Name three common indicators of compromise.
Show answer
IP addresses, domain names, file hashes (MD5, SHA-1, SHA-256)- What is a C2 channel in the context of detection?
Show answer
Command and control channel; the communication path an attacker uses to control compromised systems- Define a false positive in threat detection.
Show answer
A legitimate activity or event incorrectly identified as a security threat- What is behavioral analysis in endpoint detection?
Show answer
Monitoring system processes and user actions for patterns consistent with known attack techniques, rather than matching signatures- Name the MITRE framework commonly used to map adversary tactics and techniques.
Show answer
MITRE ATT&CK- What is the Cyber Kill Chain?
Show answer
A seven-step model describing the phases of a cyberattack: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives- What log type is most useful for detecting lateral movement within a network?
Show answer
Windows Event Logs (especially event ID 4624 for logon events) or syslog from network devices- Define a zero-day indicator.
Show answer
An observable artifact from an attack exploiting a previously unknown vulnerability that has no publicly disclosed fix- What is threat hunting?
Show answer
Proactively searching network logs and data for signs of compromise or suspicious behavior that automated detection may have missed- What does STIX stand for?
Show answer
Structured Threat Information Expression; a standardized format for representing and sharing threat intelligence data- Name a common source of paid threat intelligence.
Show answer
Commercial threat intelligence vendors, dark web monitoring services, exploit databases, or intelligence-sharing communities- What is a false negative in detection?
Show answer
A real security incident or malicious activity that the detection system fails to identify
FlashKeepers