CSA 312-39 Exam Questions and Answers PDF

Strategic threat intelligence is aimed at executive and program-level decision-making. It focuses on high-level risk trends, geopolitical drivers, adversary motivations, target selection, and emerging threat landscapes that influence long-term security posture and investment priorities. The question emphasizes senior management concerns, long-term implications, and broad risks affecting financial institutions—hallmarks of strategic intelligence. Technical intelligence is focused on specific indicators (IPs, domains, hashes) and technical artifacts for immediate detection. Tactical intelligence focuses on adversary tactics, techniques, and procedures (TTPs) that help defenders improve detections and controls. Operational intelligence is more immediate, relating to current campaigns, adversary capabilities, and near-term targeting information used for active defense and incident response. While tactical and operational intelligence are valuable for SOC detections and playbooks, the requirement here is “high-level risks and long-term implications,” which maps most directly to strategic threat intelligence.

This scenario aligns with requirement analysis because the team is defining what intelligence is needed and how it should be collected and used. The analyst has observed a problem (possible DGA-based malware activity) and recognizes gaps in current detection. The next step in a CTI lifecycle is to translate that concern into actionable intelligence requirements: which telemetry sources are necessary (DNS logs, proxy logs, endpoint telemetry, threat intel on DGA families), what questions must be answered (which hosts, what domains, what patterns, what time windows), and what success criteria look like (detection thresholds, false positive tolerance, enrichment needs). This is the “direction” phase of CTI, where priorities are set and collection needs are specified to ensure intelligence efforts align to threats that matter. “Filtering CTI” would be about reducing noise in collected intelligence or refining feeds after collection. “Intelligence buy-in” is stakeholder alignment and program support, not the analytic definition of requirements. “Automated tool” is not a CTI lifecycle stage. From a SOC perspective, requirement analysis is critical to turn observations into structured detection and hunting objectives that can be measured and improved.

Host-based artifacts are the most direct evidence to confirm persistence and recurring execution on an endpoint. The scenario already describes classic host persistence mechanisms: scheduled tasks and registry autorun modifications. To confirm and mitigate, a threat hunter should focus on endpoint-resident artifacts such as: persistence entries (scheduled tasks, Run/RunOnce keys, services, WMI subscriptions), process ancestry (which parent launches the malicious script), file system changes (dropped scripts, DLLs, staged payloads), and security control tampering. These artifacts enable containment and eradication because they point to what must be removed and what must be prevented from re-creating itself after reboot. Network-based artifacts are important for identifying C2 destinations and potential lateral movement, but they won’t fully explain how the malware survives termination. Threat intelligence context can help attribute and match TTPs, but it’s not required to confirm persistence locally. Indicators of Attack are behavior patterns (like scheduled task creation, registry autoruns, process injection) and are valuable conceptually, but the option that best represents the concrete evidence you need to examine and remediate on the endpoint is “host-based artifacts.” In SOC response, you’d combine host artifact removal with credential resets and scoping for similar persistence across endpoints.

A SOC Analyst would use Netstat Data tomonitor connections to insecure ports. Netstat, which stands for network statistics, is a command-line tool that displays incoming and outgoing network connections (both TCP and UDP), routing tables, and a number of network interface and network protocol statistics. It is available on various operating systems, including Windows, Linux, and Unix, and is used for finding problems in the network and to determine the amount of traffic on the network as a performance measurement.