A security analyst at a managed security service provider (MSSP) is triaging an alert for a suspicious file. The file hash matches an indicator from a commercial feed, but the analyst wants to verify whether the file is actually malicious before notifying the customer. Which additional IOC type would provide the strongest corroborating evidence?

The file's SHA-256 hash from a different open-source feed.

The file's compilation timestamp as extracted from the portable executable (PE) header.

A domain name that the file's command-and-control (C2) traffic resolves to, also present in the same feed.

The file's size in bytes as reported by the endpoint detection and response (EDR) tool.

A national CERT has identified a new malware campaign targeting the financial sector. They want to publish indicators in a machine-readable format that other organizations' security tools can automatically consume. Which combination of actions best achieves this goal?

Publish a PDF advisory with the indicators and post it on the CERT's website.

Send the indicators in a private email to a small list of trusted contacts.

Author STIX 2.1 objects for the campaign and publish them via a TAXII 2.1 server.

Create a spreadsheet with the indicators and share it via a public file-sharing service.

A small manufacturing company has no dedicated threat research team and a limited budget. They need a baseline of known malicious indicators to block at their firewall, but they also want to avoid the risk of acting on unvetted data. Which feed type best balances cost and reliability for their situation?

A commercial feed with a service-level agreement (SLA) and vendor validation.

An internal feed built from the company's own historical firewall logs.

A free open-source feed with no quality guarantees.

A peer-to-peer sharing group with no formal validation process.

CiscoCertified Network Professional Security

Domain 1Objective 7

1.7 Describe Security Intelligence Authoring, Sharing, and Consumption 350-701 Practice Questions (Page 4)

Part of the Security Concepts domain, which accounts for 20% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

8concepts

20%of the exam

Questions 16–20

16application · medium
A security analyst at a managed security service provider (MSSP) is triaging an alert for a suspicious file. The file hash matches an indicator from a commercial feed, but the analyst wants to verify whether the file is actually malicious before notifying the customer. Which additional IOC type would provide the strongest corroborating evidence?
Select an answer first
17application · medium
A national CERT has identified a new malware campaign targeting the financial sector. They want to publish indicators in a machine-readable format that other organizations' security tools can automatically consume. Which combination of actions best achieves this goal?
Select an answer first
18foundation · easy
Which type of threat intelligence feed typically offers more curated and timely data?
Select an answer first
19application · medium
A small manufacturing company has no dedicated threat research team and a limited budget. They need a baseline of known malicious indicators to block at their firewall, but they also want to avoid the risk of acting on unvetted data. Which feed type best balances cost and reliability for their situation?
Select an answer first
20foundation · easy
What is the first stage in the intelligence lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

1.7 Describe Security Intelligence Authoring, Sharing, and Consumption 350-701 Practice Questions (Page 4)

Questions 16–20

A national CERT has identified a new malware campaign targeting the financial sector. They want to publish indicators in a machine-readable format that other organizations' security tools can automatically consume. Which combination of actions best achieves this goal?

Which type of threat intelligence feed typically offers more curated and timely data?

What is the first stage in the intelligence lifecycle?

Keep studying — Security Concepts