Análisis completo de GIAC Cyber Threat Intelligence (GCTI): lo que muestra el informe de US$39

Una pregunta real del análisis completo

Así aparece en el informe cada pregunta que fallas. La pregunta, la respuesta correcta, la explicación y la fuente son reales. La respuesta que se muestra como tuya es un ejemplo, no son datos de nadie.

Two vendors publish reports on a campaign with overlapping techniques. CrowdStrike refers to the group as 'COZY BEAR' and Microsoft refers to it as 'MIDNIGHT BLIZZARD' (formerly 'NOBELIUM'). Which framework consolidates these naming conventions and provides a vendor-neutral identifier?

• A MITRE ATT&CK Groups catalog (vendor-neutral group identifiers and aliases)
• B NIST SP 800-53
• C OWASP Top 10
• D CISA KEV catalog

Respuesta de ejemplo, marcada como segura: B · Respuesta correcta: A

A is correct. MITRE ATT&CK keeps a Groups catalog where each tracked group has one vendor-neutral ID and a list of the names other vendors use. APT29 is G0016, and its associated names include Cozy Bear, NOBELIUM and Midnight Blizzard. An analyst can map both vendor reports to G0016 and compare techniques in one place. B is wrong because NIST SP 800-53 is a catalog of security and privacy controls and does not track threat groups. C is wrong because the OWASP Top 10 ranks web application security risks. D is wrong because the CISA KEV catalog lists vulnerabilities known to be exploited, keyed by CVE, not by actor. Rule to remember: to reconcile vendor names for a threat group, look up its ATT&CK group ID.