D340 Cyber Defense and Countermeasures - Set 5 - Part 3

Correct Answer: Providing a safe channel for researchers to report vulnerabilities

A clear disclosure policy invites good-faith reporting with defined expectations and legal safe harbor, so vulnerabilities reach the organization rather than the public or criminals.

Correct Answer: Offering rewards to researchers who responsibly report valid vulnerabilities

Bug bounties incentivize security researchers to find and responsibly report vulnerabilities, supplementing internal testing with diverse external expertise.

Correct Answer: Prioritizing defenses against techniques adversaries actually use against similar targets

Threat intelligence focuses limited defensive resources on the techniques and actors genuinely relevant to the organization rather than hypothetical threats.

Correct Answer: Strategic informs long-term planning; tactical supports immediate detection

Strategic intelligence informs risk and investment decisions over time, while tactical intelligence such as indicators supports immediate detection and blocking.

Correct Answer: Indicators such as IP addresses and hashes change rapidly and expire quickly

Atomic indicators are easily changed by attackers, so intelligence about behaviors and techniques provides more durable defensive value than transient indicators.

Correct Answer: Detecting attacker behaviors causes more difficulty for adversaries than blocking indicators

The pyramid of pain shows that blocking hashes or IPs is trivially circumvented, while detecting tools, techniques, and behaviors forces costly attacker adaptation.

Correct Answer: Learning from attacks experienced by peers before being targeted similarly

Sharing threat information lets organizations prepare for techniques already used against similar targets, converting one organization's incident into collective defense.

Correct Answer: Demonstrated ability to detect, contain, and recover from real attacks

Maturity is proven by demonstrated outcomes under real conditions, measured through detection and containment performance and validated by realistic exercises.

Correct Answer: Threats, technology, and the environment change constantly

Adversaries adapt and environments change constantly, so a defense established once inevitably decays. Sustained effectiveness requires continuous adaptation and improvement.

Correct Answer: Prevention, detection, and response capability appropriate to actual risk

Since prevention will eventually fail, mature programs invest proportionately across prevention, detection, and response, calibrated to the organization's actual risk profile.