CREST CPTIA : CREST Practitioner Threat Intelligence Analyst

Identify Sarbanes-Oxley Act (SOX) Title, which consists of only one section, that includes measures designed to help restore investor confidence in the reporting of securities analysts.

• A. Title V: Analyst Conflicts of Interest
• B. Title IX: White-Collar-Crime Penalty Enhancement
• C. Title VIII: Corporate and Criminal Fraud Accountability
• D. Title VII: Studies and Reports

During the process of detecting and containing malicious emails, incident responders should examine the originating IP address of the emails.
The steps to examine the originating IP address are as follow:
1. Search for the IP in the WHOIS database
2. Open the email to trace and find its header
3. Collect the IP address of the sender from the header of the received mail
4. Look for the geographic address of the sender in the WHOIS database
Identify the correct sequence of steps to be performed by the incident responders to examine originating IP address of the emails.

• A. 2-->1-->4-->3
• B. 1-->3-->2-->4
• C. 2-->3-->1-->4
• D. 4-->1-->2-->3

Sam works as an analyst in an organization named InfoTech Security. He was asked to collect information from various threat intelligence sources. In meeting the deadline, he forgot to verify the threat intelligence sources and used data from an open-source data provider, who offered it at a very low cost. Through it was beneficial at the initial stage but relying on such data providers can produce unreliable data and noise putting the organization network into risk.
What mistake Sam did that led to this situation?

• A. Sam used unreliable intelligence sources.
• B. Sam did not use the proper standardization formats for representing threat data.
• C. Sam did not use the proper technology to use or consume the information.
• D. Sam used data without context.

Darwin is an attacker residing within the organization and is performing network sniffing by running his system in promiscuous mode. He is capturing and viewing all the network packets transmitted within the organization. Edwin is an incident handler in the same organization.
In the above situation, which of the following Nmap commands Edwin must use to detect Darwin's system that is running in promiscuous mode?

• A. nmap -sU -p 500
• B. nmap --script hostmap
• C. nmap --script=sniffer-detect [Target IP Address/Range of IP addresses]
• D. nmap -sV -T4 -O -F -version-light

Moses, a threat intelligence analyst at InfoTec Inc., wants to find crucial information about the potential threats the organization is facing by using advanced Google searchoperators. He wants to identify whether any fake websites are hosted at the similar to the organization's URL.
Which of the following Google search queries should Moses use?

• A. related: www.infothech.org
• B. info: www.infothech.org
• C. cache: www.infothech.org
• D. link: www.infothech.org