A security operations center (SOC) manager wants to improve the quality of the threat intelligence their team produces. The team currently collects raw logs and immediately publishes indicators without analysis. Which stage of the intelligence lifecycle is the team skipping, and what is the likely consequence?

Collection; they are not gathering enough raw data from diverse sources.

Feedback; they are not incorporating consumer input to improve future intelligence.

Dissemination; they are not distributing the intelligence to the right consumers.

Processing and exploitation; they are publishing unrefined data that may contain false positives.

What is a characteristic of an open-source threat intelligence feed?

It is only available to government agencies

It is always more accurate than commercial feeds

It is freely available to the public

It requires a paid subscription

How does a firewall typically consume threat intelligence?

By authenticating users with certificates

By encrypting all outbound traffic

By generating new intelligence from logs

By blocking traffic to known malicious IPs or domains

What is the purpose of STIX in threat intelligence?

To structure and represent threat intelligence data

To transport intelligence over the network

To store intelligence in a database

CiscoCertified Network Professional Security

Domain 1Objective 7

1.7 Describe Security Intelligence Authoring, Sharing, and Consumption 350-701 Practice Questions (Page 3)

Part of the Security Concepts domain, which accounts for 20% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

8concepts

20%of the exam

Questions 11–15

11application · medium
A security operations center (SOC) manager wants to improve the quality of the threat intelligence their team produces. The team currently collects raw logs and immediately publishes indicators without analysis. Which stage of the intelligence lifecycle is the team skipping, and what is the likely consequence?
Select an answer first
12foundation · easy
What is a characteristic of an open-source threat intelligence feed?
Select an answer first
13foundation · easy
How does a firewall typically consume threat intelligence?
Select an answer first
14foundation · easy
What is the purpose of STIX in threat intelligence?
Select an answer first
15foundation · easy
Which protocol is designed to exchange STIX-formatted threat intelligence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

1.7 Describe Security Intelligence Authoring, Sharing, and Consumption 350-701 Practice Questions (Page 3)

Questions 11–15

What is a characteristic of an open-source threat intelligence feed?

How does a firewall typically consume threat intelligence?

What is the purpose of STIX in threat intelligence?

Which protocol is designed to exchange STIX-formatted threat intelligence?

Keep studying — Security Concepts