CREST Practitioner Threat Intelligence Analyst Sample Questions:

1. Investigator Ian gives you a drive image to investigate. What type of analysis are you performing?

A) Live
B) Real-time
C) Dynamic
D) Static

2. Jim works as a security analyst in a large multinational company. Recently, a group of hackers penetrated into their organizational network and used a data staging technique to collect sensitive data. They collected all sorts of sensitive data about the employees and customers, business tactics of the organization, financial information, network infrastructure information and so on.
What should Jim do to detect the data staging before the hackers exfiltrate from the network?

A) Jim should monitor network traffic for malicious file transfers, file integrity monitoring, and event logs.
B) Jim should analyze malicious DNS requests, DNS payload, unspecified domains, and destination of DNS requests.
C) Jim should identify the web shell running in the network by analyzing server access, error logs, suspicious strings indicating encoding, user agent strings, and so on.
D) Jim should identify the attack at an initial stage by checking the content of the user agent field.

3. Jason is setting up a computer forensics lab and must perform the following steps: 1. physical location and structural design considerations; 2. planning and budgeting; 3. work area considerations; 4. physical security recommendations; 5. forensic lab licensing; 6. human resource considerations. Arrange these steps in the order of execution.

A) 5-> 2-> l-> 3-> 4-> 6
B) 2->3->l ->4->6->5
C) 3 .> 2 -> 1 -> 4-> 6-> 5
D) 2 -> 1 -> 3 -> 6 -> 4 -> 5

4. Identify Sarbanes-Oxley Act (SOX) Title, which consists of only one section, that includes measures designed to help restore investor confidence in the reporting of securities analysts.

A) Title VII: Studies and Reports
B) Title VIII: Corporate and Criminal Fraud Accountability
C) Title IX: White-Collar-Crime Penalty Enhancement
D) Title V: Analyst Conflicts of Interest

5. Sam works as an analyst in an organization named InfoTech Security. He was asked to collect information from various threat intelligence sources. In meeting the deadline, he forgot to verify the threat intelligence sources and used data from an open-source data provider, who offered it at a very low cost. Through it was beneficial at the initial stage but relying on such data providers can produce unreliable data and noise putting the organization network into risk.
What mistake Sam did that led to this situation?

A) Sam did not use the proper technology to use or consume the information.
B) Sam used data without context.
C) Sam used unreliable intelligence sources.
D) Sam did not use the proper standardization formats for representing threat data.

Solutions: