What Should an Org Do First with Threat Intelligence on a Targeted Web Server?
An organization receives intelligence information about a foreign adversary targeting instances of a web server application that the organization uses. The information includes: • The originating IP addresses of the attack • The common commands run on the affected device • The indicators that a device has been affected • The actions that can be taken on the device to stop the attack Which of the following should the organization do first?
Community Insight
This question tests whether you know how to operationalize threat intelligence first: converting provided IOCs and adversary behavior into concrete detection/prevention rules rather than writing procedural documents.
When an organization receives actionable threat intelligence about an adversary targeting its web server application—including malicious IP addresses, commands, indicators, and mitigation actions—the first step is to operationalize that intelligence immediately by creating detection and prevention rules. Snort rules can block or flag traffic from the known malicious IPs, and YARA rules can identify associated malicious patterns or files on endpoints.
Many test-takers choose B (Build TTPs) because it sounds strategically important, but the intelligence already contains the adversary's tactics, techniques, and procedures—so building TTPs duplicates what was received rather than acting on it.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The threat intelligence already provides specific, actionable indicators: originating IP addresses, commands executed, signs of compromise, and mitigation actions. The most immediate defensive step is to translate these IOCs into technical controls—Snort rules to detect or block traffic from the known malicious IPs at the network boundary, and YARA rules to scan endpoints for the file patterns or behavioral signatures described in the intelligence. This is the core principle of operationalizing threat intelligence: turning raw indicators into detection content as the first concrete action. Both Snort and YARA directly leverage the specific data points (IPs and indicators) that the intelligence report provides.Why the Other Options Are Wrong
Option A (Draft an incident response playbook) is a reactive planning activity typically developed proactively or updated after incidents; drafting one now delays immediate defensive measures and doesn't directly use the provided IOCs. Option B (Build TTPs) is incorrect as a first step because the intelligence report already contains the adversary's tactics, techniques, and procedures—building TTPs would be redundant and doesn't act on the information. Option D (Configure user behavior analytics) targets insider or anomalous user behavior, which is irrelevant when the threat comes from an external adversary with known IP addresses and defined attack patterns.Community Comment Notes
Commenter c289594 correctly identified Snort and YARA as complementary tools—Snort for network traffic from the identified IPs and YARA for file-based pattern matching—supporting answer C. Trynapasslol emphasized that the first priority is to mitigate the risk immediately, aligning with creating actionable detection rules rather than procedural documents. Skri113xX argued for B, but building TTPs duplicates what the intelligence already provides rather than acting on it.Official Reference
Exam Strategy
When a question presents threat intelligence with specific IOCs (IPs, commands, indicators), the first action is almost always to create detection/prevention rules that directly use those IOCs—look for options that mention specific tools like Snort, YARA, or SIEM rule creation rather than generic planning or procedural activities.
Frequently Asked Questions
Why is building TTPs the wrong first step when the question mentions adversary behavior?
The intelligence report already contains the adversary's tactics, techniques, and procedures—such as commands run and mitigation actions. Building TTPs would duplicate the provided information instead of acting on it immediately.
Why isn't drafting an incident response playbook the correct first action?
An IR playbook is a reactive planning document typically prepared in advance or updated after incidents. With specific IOCs in hand, the priority is creating detection and prevention rules to mitigate the threat now.
Related Analysis
Practice All CAS-005 Questions
Access 135 questions with complete answers and detailed explanations.
View Full CAS-005 Practice Test →