Use Threat Intelligence Techniques to Identify Potential Network Vulnerabilities 100-160 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security operations team subscribes to a commercial threat intelligence feed that provides indicators of compromise (IOCs) and contextual reports. The team also monitors free industry news sites and vendor blogs. The team wants to improve its ability to detect emerging threats before they affect the organization. What is the most effective use of these sources?

   • AAutomatically ingest the commercial feed into the SIEM and correlate it with internal logs, while using free sources for additional context.
   • BUse only free sources to avoid subscription costs, because they are sufficient for threat detection.
   • CRely solely on the commercial feed because it is more reliable than free sources.
   • DManually review all sources daily and create custom alerts for each new threat.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   An organization needs to automate vulnerability scanning of its servers and generate compliance reports. Which tool is best suited for this purpose?

   • Atcpdump
   • BHashcat
   • CNessus
   • DBurp Suite
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization wants to improve its threat intelligence capabilities by participating in a collective intelligence effort. Which option best represents this approach?

   • AJoining an Information Sharing and Analysis Center (ISAC) relevant to their industry.
   • BPurchasing a commercial threat feed and keeping the data internal.
   • CHiring a penetration testing firm to conduct quarterly assessments.
   • DRelying on public CVE databases like NVD for all threat information.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of an automated threat intelligence process?

   • AA SIEM that automatically correlates logs with threat feeds
   • BA paper-based incident response plan
   • CA manual review of security advisories by an analyst
   • DA monthly meeting to discuss security trends
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is investigating a suspicious email campaign that appears to target their organization. The analyst wants to use ad hoc threat intelligence to understand the threat. Which action is most consistent with ad hoc threat intelligence?

   • AIgnoring the campaign because it is likely a false positive.
   • BWaiting for the next scheduled threat intelligence feed update.
   • CSearching public malware analysis sandboxes and security blogs for similar email campaigns.
   • DDeploying a new SIEM rule to detect the email campaign automatically.
   Reveal Solution Discussion Select an answer first