Free Threat Intelligence, CVE, and CVSS practice questions
10 free SY0-801 questions on Threat Intelligence, CVE, and CVSS, each with a full explanation — no account needed. This section sits in the Threats, Vulnerabilities, and Attacks part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
A threat intelligence team wants one standard, JSON-based language for describing threat actors, campaigns, malware and indicators, including the relationships that link them. Which standard fits?
STIX is the language for describing threat intelligence: version 2.1 uses JSON objects such as threat actor, campaign, malware and indicator, plus relationships that link them. TAXII is the HTTPS transport that carries STIX content between systems, TLP labels how far shared information may travel, and CWE catalogs software weakness types.
An analyst investigating a phishing domain finds related attacker domains by searching WHOIS registration details and certificate transparency logs, then reads a researcher's blog post about the campaign. What kind of intelligence source is the analyst using?
Publicly available material such as WHOIS records, certificate transparency logs and researchers' blogs is open-source intelligence (OSINT). Proprietary intelligence is sold by a vendor as a subscription, an ISAC shares information among members of one sector, and dark web monitoring searches criminal forums and leak sites.
A CISO asks for a briefing the board can use when setting next year's security budget. It should explain which kinds of attackers target the company's sector, why they do it, and how that trend has changed over the past year. Which level of threat intelligence is this?
Strategic intelligence answers who targets the organization, why, and what the trends mean for the business, and its audience is executives and the board. Operational intelligence describes a specific campaign that is active now for SOC leads and responders, while tactical and technical intelligence are the indicators and detection rules fed to tools.
A threat hunting lead receives a report that a named group began exploiting a file transfer appliance flaw against logistics companies this week, describing how the group gets in and what it installs afterward. The report contains no hashes, IP addresses or detection rules. Which level of intelligence is it?
Details about a specific campaign that is active now, and how it operates, are operational intelligence, written to help hunters and responders prepare before it reaches them. Tactical and technical intelligence are the exact indicators and rules to detect or block, which this report lacks, and strategic intelligence covers long-term trends for executives rather than one current campaign.
A retailer wants early warning if employee passwords harvested by infostealer malware, or files taken from its network, are offered for sale on criminal forums and leak sites. Which source BEST fits this need?
Dark web monitoring searches criminal forums, marketplaces and leak sites for the organization's own credentials and data, which is exactly the warning described. An ISAC shares sector-wide threat information rather than watching for one company's stolen data, vendor advisories cover flaws in products, and an IP reputation feed lists malicious addresses.
Hours after a free IP blocklist is switched straight into blocking mode, staff lose access to several legitimate cloud applications because the list includes addresses shared by a content delivery network. Which feed quality failed, and what step would have caught it?
Benign addresses on a blocklist are false positives, which is an accuracy failure, and running a new feed in alert-only mode before it blocks anything exposes them safely. Timeliness concerns how quickly indicators appear and are retired, relevance concerns fit to the sector and technology, and confidence is how sure the producer is, so none of them describes legitimate addresses listed as malicious.
Which change would MOST directly increase the impact of a breach of a company file server, rather than the likelihood of one?
Impact depends on what the asset and its data are worth to the business, and leaked patient records bring notification duties, fines and lost trust. Internet exposure, public exploit code and weaker authentication all make a successful attack more probable, so they raise likelihood while the damage from a breach stays the same.
A security team wants the control that would MOST reduce the chance that stolen employee passwords give an attacker a working login. Which control fits?
MFA lowers likelihood, because a stolen password alone no longer completes a sign-in. Backups, insurance and encryption at rest mainly reduce impact after something goes wrong: backups restore data, insurance transfers financial loss and encryption keeps stolen data unreadable, but none of them stops a stolen password from working.
Which control makes a sensitive system harder for an attacker to reach and also limits how far an intruder can spread after getting in?
Segmentation works on both sides of the risk equation: it lowers likelihood by restricting who can reach a system and lowers impact by containing an intruder who is already inside. Phishing training mainly lowers likelihood, while insurance and backups mainly lower impact after an attack succeeds.
A VPN flaw was disclosed and patched several years ago, yet it still appears on government lists of routinely exploited vulnerabilities. Which stage of the threat life cycle explains why attackers keep using it?
In the long tail, most systems have been patched but attackers keep exploiting the stragglers for years, which is why old flaws stay on routinely exploited lists. Weaponization is when public exploit code first appears and mass scanning starts, disclosure is when the advisory and patch are published, and a zero-day is used before anyone else knows the flaw exists.
Study this section
Every lesson that covers Threat Intelligence, CVE, and CVSS on the SY0-801 exam.