1.7 Describe Security Intelligence Authoring, Sharing, and Consumption 350-701 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A hospital's security team has integrated a threat intelligence feed into their SIEM. They notice that the SIEM is generating a high volume of alerts for domain lookups that are not actually malicious. The feed includes domains that are commonly used by legitimate software for updates. What is the most effective way to reduce these false positives?

   • ADisable the domain-based indicators from the feed entirely.
   • BIncrease the severity threshold for all domain-based alerts.
   • CSwitch to a different commercial feed without evaluating its content.
   • DCreate an allowlist of known legitimate domains and apply it to the SIEM correlation rules.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the first step in the security intelligence authoring process?

   • APublishing the intelligence to a TAXII server
   • BFormatting indicators into a standard like STIX
   • CConfiguring a SIEM to consume the intelligence
   • DIdentifying the threats to address
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A threat researcher has identified a new phishing campaign that uses a specific sender domain and a unique attachment hash. The researcher wants to share these indicators with the community in a way that preserves the relationship between the two indicators. Which STIX 2.1 object structure should the researcher use?

   • ACreate two Indicator objects and one Relationship object linking them.
   • BCreate a single Indicator object with both the domain and hash as patterns.
   • CCreate a Campaign object and embed the domain and hash as custom properties.
   • DCreate two separate Indicator objects with no relationship.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of a SIEM consuming threat intelligence?

   • ATo enrich alerts with context about known threats
   • BTo replace the need for log collection
   • CTo generate new threat intelligence automatically
   • DTo encrypt logs at rest
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   Two organizations in the same industry want to share threat intelligence with each other but are concerned about exposing sensitive internal details. They agree to share only indicators of compromise (IOCs) and not full reports. Which trust model and format combination is most appropriate?

   • AA peer-to-peer mesh with anonymous sharing.
   • BA public open-source feed with no formal agreement.
   • CA commercial feed subscription with a standard license.
   • DA bilateral agreement using STIX 2.1 indicators exchanged via TAXII 2.1.
   Reveal Solution Discussion Select an answer first