Cyber Threat Intelligence MCQs (Multiple-Choice Questions)

1. What is the primary purpose of Cyber Threat Intelligence (CTI)?

1. To collect as much security data as possible without analyzing it
2. To transform information about cyber threats into knowledge that supports security decisions
3. To replace every cybersecurity control with threat reports
4. To guarantee that cyberattacks cannot occur

Answer: B) To transform information about cyber threats into knowledge that supports security decisions

Explanation:

Cyber Threat Intelligence converts relevant threat data into contextualized and analyzed information that can support decisions. Organizations can use CTI to prioritize risks, improve detections, investigate incidents, prepare for adversary behavior, and allocate security resources.

2. Which statement best distinguishes threat intelligence from raw threat data?

1. Threat intelligence contains analyzed context and relevance, while raw data may consist only of unprocessed observations
2. Raw data is always more useful than analyzed intelligence
3. Threat intelligence contains no information about adversaries
4. There is no difference between threat data and threat intelligence

Answer: A) Threat intelligence contains analyzed context and relevance, while raw data may consist only of unprocessed observations

Explanation:

A list of suspicious IP addresses or file hashes is primarily data until it is evaluated and placed in context. Intelligence explains factors such as why the information matters, which threat it relates to, how reliable it is, and what actions an organization should consider.

3. Which type of threat intelligence is primarily intended to support senior management and long-term security decisions?

1. Strategic threat intelligence
2. Packet-level intelligence
3. Technical debugging information
4. Application source-code comments

Answer: A) Strategic threat intelligence

Explanation:

Strategic threat intelligence focuses on broad trends, business risks, geopolitical factors, adversary motivations, and long-term changes in the threat environment. It is often presented to executives, risk leaders, and other decision-makers rather than only to technical analysts.

4. What does tactical threat intelligence commonly describe?

1. Employee payroll information
2. Adversary tactics, techniques, and procedures
3. Only the financial cost of security products
4. The physical dimensions of network equipment

Answer: B) Adversary tactics, techniques, and procedures

Explanation:

Tactical intelligence helps defenders understand how adversaries conduct attacks. It can describe techniques for initial access, credential theft, persistence, lateral movement, defense evasion, and other behaviors that defenders can use to improve controls and detections.

5. What is technical threat intelligence most likely to include?

1. Indicators such as malicious IP addresses, domains, URLs, and file hashes
2. Only an organization's annual financial forecast
3. Employee performance evaluations
4. Physical office floor plans unrelated to security

Answer: A) Indicators such as malicious IP addresses, domains, URLs, and file hashes

Explanation:

Technical threat intelligence frequently contains machine-readable or directly actionable indicators that security tools and analysts can use for detection and investigation. Indicators can become outdated quickly, so their age, context, confidence, and source should be considered.

6. Which type of intelligence commonly provides information about specific campaigns, attacks, or adversary activities?

1. Operational threat intelligence
2. Payroll intelligence
3. Hardware inventory intelligence
4. Office management intelligence

Answer: A) Operational threat intelligence

Explanation:

Operational threat intelligence provides information about ongoing or anticipated adversary operations, campaigns, targets, capabilities, and activities. It can help security teams understand how a particular threat may affect their organization.

7. What is the first step in a typical threat intelligence lifecycle?

1. Deleting collected information
2. Defining intelligence requirements and priorities
3. Publishing every available indicator
4. Blocking every external IP address

Answer: B) Defining intelligence requirements and priorities

Explanation:

The intelligence process should begin by determining what decision-makers and security teams need to know. Clear intelligence requirements guide collection and analysis so that analysts focus on relevant threats instead of accumulating large amounts of unrelated data.

8. Which sequence best represents a common threat intelligence lifecycle?

1. Requirements, collection, processing, analysis, dissemination, and feedback
2. Dissemination, deletion, collection, shutdown, and replacement
3. Collection, publication, guessing, and deletion
4. Analysis, hardware installation, payroll review, and collection

Answer: A) Requirements, collection, processing, analysis, dissemination, and feedback

Explanation:

A common intelligence lifecycle begins with requirements, followed by information collection, processing, analysis, dissemination of the resulting intelligence, and feedback. Feedback can refine future requirements and improve subsequent intelligence activities.

9. What is an Intelligence Requirement (IR)?

1. A clearly defined question or information need that intelligence activities should address
2. A requirement to collect every available security log
3. A rule requiring all users to become intelligence analysts
4. A list of unrelated software applications

Answer: A) A clearly defined question or information need that intelligence activities should address

Explanation:

Intelligence requirements define what stakeholders need to understand about threats, adversaries, vulnerabilities, or risks. For example, an organization may need to know which threat actors are targeting its industry and which techniques they commonly use.

10. What is an Indicator of Compromise (IOC)?

1. An observable artifact that may indicate malicious activity or a security compromise
2. A guarantee that a system has never been attacked
3. A physical indicator showing server temperature only
4. A security policy describing employee vacation rules

Answer: A) An observable artifact that may indicate malicious activity or a security compromise

Explanation:

An IOC is an observable value or pattern associated with potentially malicious activity. Examples include suspicious file hashes, domains, IP addresses, registry changes, filenames, or other artifacts. An IOC should be interpreted in context because an individual indicator does not always prove compromise.

11. Which of the following is an example of a file-based IOC?

1. A cryptographic hash associated with a malicious executable
2. An employee's department name
3. A monitor's screen resolution
4. A server rack number

Answer: A) A cryptographic hash associated with a malicious executable

Explanation:

Cryptographic hashes can identify specific file content and are commonly used to describe known malware samples. However, an attacker can modify a file and produce a different hash, so defenders should not depend only on file hashes for long-term detection.

12. What does TTP stand for in Cyber Threat Intelligence?

1. Threat Tracking Protocol
2. Tactics, Techniques, and Procedures
3. Technical Transfer Process
4. Trusted Transmission Platform

Answer: B) Tactics, Techniques, and Procedures

Explanation:

TTPs describe how adversaries operate. Tactics represent broader objectives, techniques describe approaches used to accomplish those objectives, and procedures describe particular implementations or sequences of actions observed in real incidents.

13. Why can TTP-based intelligence remain useful longer than some individual IOCs?

1. Adversaries may change domains or file hashes more easily than established attack behaviors
2. TTPs can never change
3. File hashes remain valid for every malware variant
4. TTPs require no analysis

Answer: A) Adversaries may change domains or file hashes more easily than established attack behaviors

Explanation:

Infrastructure and file indicators can be replaced quickly. Some adversary techniques require more effort to change because they reflect established tools, knowledge, workflows, or access methods. Behavioral detection based on techniques can therefore complement IOC-based detection.

14. What is the MITRE ATT&CK framework commonly used for?

1. Organizing knowledge about adversary tactics and techniques
2. Calculating employee salaries
3. Replacing all network monitoring systems
4. Generating encryption keys for every application

Answer: A) Organizing knowledge about adversary tactics and techniques

Explanation:

MITRE ATT&CK provides a structured knowledge base describing adversary behaviors observed in real-world activity. Security teams can use it to map detections, analyze incidents, evaluate defensive coverage, conduct threat-informed exercises, and communicate about attacker behavior.

15. In MITRE ATT&CK terminology, what does a tactic generally represent?

1. The adversary's broader objective or reason for performing an action
2. A specific malicious IP address
3. A cryptographic algorithm
4. The physical location of a security analyst

Answer: A) The adversary's broader objective or reason for performing an action

Explanation:

A tactic describes an adversary's objective at a particular stage of activity. Examples include initial access, persistence, privilege escalation, credential access, discovery, lateral movement, collection, and exfiltration.

16. What is threat attribution?

1. The process of assessing who may be responsible for malicious cyber activity
2. The process of automatically deleting all suspicious files
3. The process of assigning passwords to employees
4. The process of measuring network bandwidth

Answer: A) The process of assessing who may be responsible for malicious cyber activity

Explanation:

Threat attribution attempts to associate malicious activity with a particular actor, group, or operation using evidence such as infrastructure, malware, techniques, targeting, timing, and historical patterns. Attribution is often uncertain because attackers can deliberately imitate others or conceal their origins.

17. Why should analysts assign confidence levels to intelligence assessments?

1. To communicate the degree of certainty supported by available evidence and analysis
2. To make every assessment appear certain
3. To eliminate the need to document sources
4. To ensure all intelligence receives the same priority

Answer: A) To communicate the degree of certainty supported by available evidence and analysis

Explanation:

Intelligence frequently contains uncertainty. Confidence statements help consumers understand how strongly the available evidence supports an assessment. Analysts should distinguish confidence from the severity or potential impact of a threat.

18. What is source reliability in threat intelligence analysis?

1. An assessment of how dependable a source has been or is expected to be
2. The number of words in an intelligence report
3. The physical distance between the source and analyst
4. The speed of the analyst's computer

Answer: A) An assessment of how dependable a source has been or is expected to be

Explanation:

Source reliability concerns the trustworthiness and track record of the source providing information. Analysts should also evaluate the credibility of the specific information because a generally reliable source can still provide incomplete or inaccurate information.

19. What does corroboration mean in threat intelligence?

1. Confirming or strengthening information using additional independent evidence
2. Copying the same claim repeatedly from one original source
3. Deleting information that disagrees with an initial assumption
4. Automatically assigning maximum confidence to every report

Answer: A) Confirming or strengthening information using additional independent evidence

Explanation:

Corroboration involves checking information against other evidence or independent sources. Analysts should determine whether multiple reports actually originate from different evidence rather than simply repeating the same original claim.

20. What is Open-Source Intelligence (OSINT)?

1. Intelligence derived from publicly available information
2. Information that can only be obtained from classified systems
3. Data stored exclusively on offline computers
4. Intelligence collected only through malware execution

Answer: A) Intelligence derived from publicly available information

Explanation:

OSINT uses publicly accessible sources such as websites, public reports, security research, public repositories, technical documentation, and other openly available information. Analysts still need to verify sources and assess the reliability and relevance of collected material.

21. What is a threat intelligence feed?

1. A continuously or periodically delivered stream of threat-related data or intelligence
2. A system used only for employee messaging
3. A replacement for every security analyst
4. A hardware component used to power a firewall

Answer: A) A continuously or periodically delivered stream of threat-related data or intelligence

Explanation:

Threat intelligence feeds can provide indicators, vulnerability information, malicious infrastructure data, or other threat-related observations. Feed quality varies, so organizations should evaluate relevance, freshness, false-positive rates, context, and source reliability before integrating data into controls.

22. Why can automatically blocking every IP address from a threat feed create problems?

1. Some indicators may be outdated, inaccurate, shared by legitimate services, or irrelevant to the organization
2. Threat feeds always contain only private IP addresses
3. IP addresses can never be used for security detection
4. Automatic blocking always increases network speed

Answer: A) Some indicators may be outdated, inaccurate, shared by legitimate services, or irrelevant to the organization

Explanation:

Indicators should be evaluated before enforcement. Cloud infrastructure, shared hosting, compromised legitimate systems, and reassigned IP addresses can make simple blocklists unreliable. Context, confidence, expiration, and potential business impact should influence automated actions.

23. What is indicator enrichment?

1. Adding context and related information to an indicator
2. Removing all metadata from an indicator
3. Converting every indicator into a password
4. Increasing the physical size of a security appliance

Answer: A) Adding context and related information to an indicator

Explanation:

Enrichment adds information such as domain registration details, historical observations, associated malware, related infrastructure, geolocation, reputation, first-seen and last-seen timestamps, or links to known campaigns. This context helps analysts decide how relevant an indicator is.

24. What does indicator aging refer to?

1. The reduction in usefulness or reliability of some indicators as time passes
2. The physical deterioration of a security analyst's computer
3. The process of making every indicator permanent
4. The number of years an organization has used a SIEM

Answer: A) The reduction in usefulness or reliability of some indicators as time passes

Explanation:

Some indicators have short useful lifetimes. Attackers may abandon infrastructure, domains may change ownership, and malicious files may be modified. Intelligence platforms can use timestamps, expiration policies, and updated observations to prevent stale indicators from generating unnecessary alerts.

25. What is STIX in the context of Cyber Threat Intelligence?

1. A structured language and format for representing cyber threat information
2. A hardware protocol for cooling servers
3. A password hashing algorithm
4. A network cable specification

Answer: A) A structured language and format for representing cyber threat information

Explanation:

Structured Threat Information Expression (STIX) provides standardized ways to represent threat-related objects and relationships, including indicators, malware, threat actors, attack patterns, vulnerabilities, campaigns, and other intelligence concepts.

26. What is TAXII primarily designed to support?

1. The exchange of cyber threat intelligence between systems
2. The physical installation of network switches
3. The encryption of hard drives without key management
4. The compilation of application source code

Answer: A) The exchange of cyber threat intelligence between systems

Explanation:

Trusted Automated Exchange of Intelligence Information (TAXII) is designed to support the communication and exchange of cyber threat intelligence. It is commonly associated with sharing structured CTI represented using STIX.

27. What is a Threat Intelligence Platform (TIP)?

1. A system used to aggregate, normalize, enrich, analyze, and distribute threat intelligence
2. A tool designed only for creating employee passwords
3. A replacement for all firewalls and endpoint controls
4. A physical device used exclusively for data backup

Answer: A) A system used to aggregate, normalize, enrich, analyze, and distribute threat intelligence

Explanation:

A TIP can combine intelligence from internal and external sources, remove duplicates, enrich indicators, manage relationships, score intelligence, and distribute relevant information to security tools and analysts. A platform still requires suitable processes and analyst oversight.

28. How can a SIEM use threat intelligence?

1. By correlating internal security events with relevant threat indicators and context
2. By physically replacing network routers
3. By preventing the collection of system logs
4. By automatically proving the identity of every threat actor

Answer: A) By correlating internal security events with relevant threat indicators and context

Explanation:

Threat intelligence can enrich SIEM events with information about suspicious infrastructure, malware, campaigns, or adversary behaviors. This context can support prioritization and investigation, but detections should account for false positives and the age and confidence of intelligence.

29. What is threat hunting?

1. A proactive search for evidence of malicious activity that may not have triggered existing alerts
2. A process for disabling all security monitoring
3. A method for automatically deleting every suspicious file
4. A process limited to installing operating system updates

Answer: A) A proactive search for evidence of malicious activity that may not have triggered existing alerts

Explanation:

Threat hunting uses hypotheses, intelligence, telemetry, and analyst investigation to search for potentially hidden malicious activity. Hunting findings can identify compromises and also reveal opportunities to improve automated detections.

30. How can threat intelligence support threat hunting?

1. By providing hypotheses, adversary behaviors, indicators, and context that guide searches
2. By guaranteeing that every hunt discovers an attacker
3. By eliminating the need for endpoint and network telemetry
4. By requiring hunters to examine only known file hashes

Answer: A) By providing hypotheses, adversary behaviors, indicators, and context that guide searches

Explanation:

Intelligence can identify relevant adversaries and their known techniques, allowing hunters to formulate focused questions. For example, analysts might search for process execution or authentication patterns associated with techniques known to be used by actors targeting their industry.

31. What is the purpose of malware analysis in Cyber Threat Intelligence?

1. To understand malicious software's behavior, capabilities, indicators, and possible relationships
2. To increase malware distribution
3. To remove the need for incident response
4. To convert malware into legitimate business software

Answer: A) To understand malicious software's behavior, capabilities, indicators, and possible relationships

Explanation:

Malware analysis can reveal network communications, persistence mechanisms, files created, commands supported, encryption behavior, and other characteristics. These findings can generate indicators and behavioral intelligence that improve detection and incident investigation.

32. What is the difference between static and dynamic malware analysis?

1. Static analysis examines a sample without executing it, while dynamic analysis observes its behavior during controlled execution
2. Static analysis always requires internet access, while dynamic analysis cannot use a computer
3. Dynamic analysis examines only filenames
4. There is no difference between the two approaches

Answer: A) Static analysis examines a sample without executing it, while dynamic analysis observes its behavior during controlled execution

Explanation:

Static analysis can inspect file structure, strings, code, imports, and metadata without running the sample. Dynamic analysis executes the sample in an appropriately isolated environment to observe behaviors such as process creation, file modifications, and network communication.

33. What is a false positive in threat detection?

1. Benign activity incorrectly identified as malicious
2. Malicious activity correctly detected as malicious
3. A threat that permanently disappears from the internet
4. A security event that cannot be logged

Answer: A) Benign activity incorrectly identified as malicious

Explanation:

A false positive occurs when legitimate activity triggers a detection intended for malicious behavior. Excessive false positives can consume analyst time and obscure important alerts, making intelligence validation and detection tuning important.

34. What is a false negative in threat detection?

1. Malicious activity that is not detected or is incorrectly treated as benign
2. Legitimate activity correctly identified as legitimate
3. A malicious file correctly blocked by an endpoint tool
4. An expired indicator removed from a threat feed

Answer: A) Malicious activity that is not detected or is incorrectly treated as benign

Explanation:

A false negative occurs when a detection mechanism fails to identify malicious activity. False negatives are particularly concerning because attackers may continue operating without generating an appropriate alert.

35. What is the purpose of intelligence prioritization?

1. To focus analysis and defensive resources on threats most relevant to organizational requirements and risks
2. To treat every threat as equally important
3. To automatically discard all low-confidence information
4. To collect only the largest available threat feeds

Answer: A) To focus analysis and defensive resources on threats most relevant to organizational requirements and risks

Explanation:

Organizations have limited time and resources. Intelligence should therefore be prioritized according to factors such as asset importance, adversary intent, exposure, industry targeting, potential impact, confidence, and current intelligence requirements.

36. What is a threat actor?

1. An individual, group, or organization associated with malicious cyber activity
2. A software patch used to repair vulnerabilities
3. A backup server used for disaster recovery
4. A security policy applied to user accounts

Answer: A) An individual, group, or organization associated with malicious cyber activity

Explanation:

Threat actors can include financially motivated criminal groups, state-linked groups, insiders, hacktivists, and other adversaries. Their motivations, capabilities, resources, and preferred targets can differ substantially.

37. Why is understanding a threat actor's motivation useful?

1. It can help analysts assess likely targets, objectives, and behaviors
2. It guarantees exact attribution of every attack
3. It eliminates the need for technical evidence
4. It determines the attacker's physical location automatically

Answer: A) It can help analysts assess likely targets, objectives, and behaviors

Explanation:

Motivation can help explain why an adversary selects certain organizations or data. Financially motivated actors may prioritize monetizable access, while espionage-oriented actors may seek sensitive information. Motivation is only one analytical factor and should be considered alongside technical evidence.

38. What is a cyber threat campaign?

1. A related set of malicious activities conducted toward particular objectives over a period of time
2. A routine operating system update
3. An organization's employee training schedule
4. A single firewall rule with no associated activity

Answer: A) A related set of malicious activities conducted toward particular objectives over a period of time

Explanation:

A campaign groups related malicious activities that share characteristics such as infrastructure, malware, targets, techniques, timing, or objectives. Campaign analysis can reveal patterns that may not be obvious from examining isolated incidents.

39. Why is historical threat intelligence useful?

1. It can reveal recurring infrastructure, techniques, targeting patterns, and relationships across incidents
2. Old intelligence is always more accurate than current intelligence
3. Historical information never requires reevaluation
4. It guarantees that adversaries will repeat exactly the same actions

Answer: A) It can reveal recurring infrastructure, techniques, targeting patterns, and relationships across incidents

Explanation:

Historical data can help analysts identify patterns and connections between current and previous activity. However, old indicators and assessments should be reevaluated because adversaries, infrastructure, and operating methods can change.

40. What is the main benefit of sharing threat intelligence between trusted organizations?

1. It can provide earlier awareness of threats and improve collective defensive knowledge
2. It guarantees that shared information is always correct
3. It removes the need to protect sensitive information
4. It makes internal security monitoring unnecessary

Answer: A) It can provide earlier awareness of threats and improve collective defensive knowledge

Explanation:

Organizations facing similar adversaries can benefit from exchanging indicators, techniques, incident observations, and defensive lessons. Sharing programs should account for data sensitivity, privacy, legal requirements, confidence, and the reliability of shared information.

41. What does the Traffic Light Protocol (TLP) help communicate?

1. How recipients may share particular information
2. The severity score of every software vulnerability
3. The speed of network traffic
4. The physical security level of a data center

Answer: A) How recipients may share particular information

Explanation:

TLP provides standardized markings that help information producers communicate expected sharing boundaries. It is useful in threat intelligence communities where information may need to be distributed to selected audiences without being shared more broadly than intended.

42. What is intelligence dissemination?

1. Delivering analyzed intelligence to the appropriate consumers in a suitable form
2. Collecting data without providing it to anyone
3. Deleting intelligence immediately after analysis
4. Publishing every intelligence report publicly

Answer: A) Delivering analyzed intelligence to the appropriate consumers in a suitable form

Explanation:

Intelligence has limited value if it does not reach the people or systems that can act on it. Dissemination should consider the audience, urgency, sensitivity, technical detail, and decisions the intelligence is intended to support.

43. Why might the same threat intelligence need different presentations for executives and SOC analysts?

1. Different audiences require different levels of context, technical detail, and decision support
2. Executives should never receive threat information
3. SOC analysts require only financial information
4. Every intelligence consumer should receive identical raw data

Answer: A) Different audiences require different levels of context, technical detail, and decision support

Explanation:

Executives may need business impact, risk trends, and strategic implications, while SOC analysts may need indicators, detection logic, timestamps, techniques, and investigative context. Tailoring intelligence improves its usefulness to each audience.

44. What is a major risk of confirmation bias during threat intelligence analysis?

1. Analysts may favor evidence supporting an existing belief while discounting contradictory information
2. Analysts automatically collect too many network packets
3. Security tools become physically damaged
4. Threat actors immediately learn the analyst's conclusions

Answer: A) Analysts may favor evidence supporting an existing belief while discounting contradictory information

Explanation:

Confirmation bias can cause analysts to interpret evidence in ways that reinforce an initial hypothesis. Structured analytical methods, peer review, alternative hypotheses, and explicit examination of contradictory evidence can reduce this risk.

45. What is the purpose of analyzing competing hypotheses in CTI?

1. To systematically compare alternative explanations against available evidence
2. To ensure the analyst's first hypothesis always wins
3. To remove uncertainty from every intelligence assessment
4. To replace evidence with intuition

Answer: A) To systematically compare alternative explanations against available evidence

Explanation:

Considering competing hypotheses encourages analysts to test several plausible explanations rather than committing too early to one conclusion. Evidence can then be evaluated according to how well it supports or contradicts each hypothesis.

46. Why is timestamp information important for threat indicators?

1. It helps analysts understand when an indicator was observed and whether it may still be relevant
2. It guarantees that the indicator is malicious
3. It determines the attacker's identity automatically
4. It prevents an indicator from producing false positives

Answer: A) It helps analysts understand when an indicator was observed and whether it may still be relevant

Explanation:

First-seen, last-seen, creation, and expiration timestamps provide important context. An IP address observed in malicious activity years ago may no longer have the same owner or purpose, while a recently active indicator may deserve greater investigative attention.

47. Which approach provides stronger long-term detection coverage against an adversary that frequently changes IP addresses and file hashes?

1. Relying exclusively on a permanent list of old IP addresses
2. Combining current indicators with behavioral detections based on relevant adversary techniques
3. Ignoring process and authentication telemetry
4. Disabling detection rules whenever an indicator changes

Answer: B) Combining current indicators with behavioral detections based on relevant adversary techniques

Explanation:

Indicators can provide precise short-term detection opportunities, while behavioral detections can identify attack methods even when infrastructure or malware changes. Combining both approaches generally provides broader coverage than relying only on easily changed indicators.

48. A threat feed reports a domain as malicious, but analysts discover that the domain has changed ownership and is now used by a legitimate organization. What should the security team do?

1. Continue blocking it permanently because historical indicators can never expire
2. Reassess the indicator, update its context or status, and modify controls as appropriate
3. Block every domain registered by the new owner
4. Delete the entire threat intelligence database

Answer: B) Reassess the indicator, update its context or status, and modify controls as appropriate

Explanation:

Indicators should be maintained throughout their lifecycle. If reliable evidence shows that an indicator is no longer malicious, analysts should update its status, confidence, timestamps, or expiration information and adjust automated controls to avoid unnecessary disruption.

49. An organization receives intelligence that a threat actor is actively targeting its industry using credential theft followed by remote access. What is the most useful response?

1. Assess whether the reported techniques apply to the organization's environment and strengthen relevant detection and preventive controls
2. Immediately disconnect every system without evaluating the intelligence
3. Ignore the report because the organization has not yet confirmed a compromise
4. Block only one IP address mentioned in the report and take no further action

Answer: A) Assess whether the reported techniques apply to the organization's environment and strengthen relevant detection and preventive controls

Explanation:

Actionable intelligence should be evaluated against the organization's assets, exposure, identity controls, telemetry, and existing detections. Relevant responses could include reviewing authentication logs, strengthening access controls, hunting for reported behaviors, and improving detection of the techniques described in the intelligence.

50. A threat intelligence team reviews 800 indicators from an external feed. After validation, 200 indicators are relevant to the organization's environment. Of those 200 relevant indicators, 150 are confirmed to be associated with malicious activity. What percentage of the relevant indicators are confirmed malicious?

1. 18.75%
2. 25%
3. 75%
4. 80%

Answer: C) 75%

Explanation:

The question asks for the percentage of relevant indicators that are confirmed malicious, so the denominator is 200 relevant indicators rather than all 800 indicators received.

Confirmed malicious indicators = 150.

Relevant indicators = 200.

Percentage confirmed malicious = (150 / 200) × 100.

Percentage confirmed malicious = 0.75 × 100 = 75%.

Therefore, 75% of the relevant indicators are confirmed to be associated with malicious activity.