Threat Intelligence and Indicators Questions

Foundational and practical knowledge of threat intelligence and indicators of compromise. Candidates should understand tactical indicators such as internet protocol addresses, domains, and file hashes; operational and strategic intelligence such as adversary profiles, campaigns, and motivations; methods for evaluating source credibility and confidence; and how to operationalize intelligence by ingesting feeds, enriching alerts and assets, creating detection content, and shaping hunting hypotheses. Candidates should also be able to discuss limitations of indicators and how to integrate intelligence into workflows.