Threat Intelligence Analyst

Sample question 1

During a post-incident review, a threat intelligence analyst at a regional healthcare network examines an intrusion in which the adversary went dormant for six hours after initial phishing access, then conducted slow, methodical reconnaissance of file shares, and only escalated to aggressive credential dumping once it found a share containing unencrypted billing records. The analyst is deciding where to focus the next round of detection content. Which conclusion about the adversary's decision-making process should most directly guide that decision?

1. A.The adversary withheld aggressive action until it located high-value data, so detections should flag the recon-to-high-value-access transition as high priority.
2. B.The six-hour dormancy shows the adversary is slow and unsophisticated, so detection effort is better spent on faster, noisier intrusions instead.
3. C.Because credential dumping followed reconnaissance here, future intrusions will likely repeat this same six-hour timeline, so reviews can be scheduled around that window.
4. D.The intrusion looks opportunistic rather than targeted, so effort is better spent on generic malware signatures than on behavior-based detection logic.

Sample question 2

In 2026, a threat intelligence analyst at a mid-size law firm reviews cloud audit logs after a paralegal reports an unexpected folder-sharing notification. The logs show a third-party application named QuickScan PDF Tools was granted delegated Mail.Read and Files.ReadWrite.All permissions through a consent prompt the paralegal does not recall approving, and the app has since called the mailbox API to retrieve messages from three other partners' accounts, all without any sign-in attempt or password entry from those accounts. Applying knowledge of adversarial tactics, tools, and techniques, what is the most likely explanation and appropriate response?

1. A.The paralegal's account was compromised through credential stuffing, so the analyst should force a password reset only for the paralegal.
2. B.This is an illicit OAuth consent grant giving persistent API access without a password, so revoke the registration and invalidate its tokens for every affected account.
3. C.The three partners' accounts were breached through a supply-chain compromise of the PDF vendor's infrastructure, so the analyst should block the vendor's IP ranges at the firewall.
4. D.A phishing email delivered a malicious macro that established a foothold on the paralegal's endpoint, so the analyst should isolate that endpoint and run an antivirus scan.

Sample question 3

You are a threat intelligence analyst at a logistics company in 2026, assessing whether a new intrusion belongs to Actor X, a group recently named in multiple press reports for a wave of attacks across your sector. Some technical indicators from the intrusion overlap with Actor X's known malware family, but the command-and-control infrastructure's registration pattern, the compiled binary's timestamp and locale strings, and the narrow operational hours of the activity do not match Actor X's established profile, and instead resemble a different, less publicized actor your team has tracked before. Your manager wants a quick attribution write-up naming Actor X, citing the press coverage. Applying your knowledge of analytical tools and techniques, what is the most defensible way to proceed?

1. A.Since Actor X is already named in several recent press reports and one malware family happens to overlap, write up the formal attribution as Actor X regardless, and mention the mismatched infrastructure and timestamp details only as a minor caveat buried in a closing footnote.
2. B.Apply a structured technique such as Analysis of Competing Hypotheses, laying out both candidate actors against each indicator, including the ones that do not fit Actor X, and let whichever hypothesis best survives the disconfirming evidence drive the attribution, even if it contradicts the press narrative.
3. C.Since some technical indicators point toward Actor X and others point away, treat attribution as unknowable and omit any actor name from the assessment, rather than applying a structured technique that could weigh the disconfirming evidence against both candidate hypotheses systematically.
4. D.Present both possible actors as equally likely candidates in the final write-up without weighing any of the indicators against each hypothesis individually, since press attention alone gives Actor X enough credibility to sit alongside the alternative candidate without further analytic comparison of the evidence.