1.7 Describe Security Intelligence Authoring, Sharing, and Consumption 350-701 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the role of IOCs in security intelligence?

   • ATo authenticate users
   • BTo encrypt sensitive data
   • CTo identify known malicious activity on a network
   • DTo manage network bandwidth
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which activity is part of security intelligence authoring?

   • ACorrelating alerts in a SIEM
   • BSubscribing to a commercial threat feed
   • CFormatting indicators into a machine-readable standard
   • DDeploying a firewall rule to block a malicious IP
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A university's network team subscribes to a commercial threat intelligence feed that includes IP addresses, domains, and file hashes. They want to automatically block traffic to known malicious destinations at the perimeter without overwhelming the firewall's rule base. Which integration approach best meets this requirement?

   • AExport the feed to a CSV and manually add each IP and domain as a static firewall rule.
   • BUpload the file hashes to the firewall's IPS signature database for blocking.
   • CCopy the feed to a web server and have the firewall fetch it as a flat text file every hour.
   • DConfigure the firewall to consume the feed via a supported API and enforce dynamic object lists for IPs and domains.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A regional bank's SOC wants to exchange structured threat intelligence with a peer institution. The bank uses a SIEM that can parse STIX 2.1 documents, and the peer runs a TAXII 2.1 server. The SOC lead needs to automate the ingestion of the peer's indicators every 30 minutes. Which approach satisfies the requirement with the least custom development?

   • AConfigure the SIEM to poll the peer's TAXII 2.1 collection via HTTPS and parse the STIX 2.1 bundles.
   • BBuild a custom script to scrape the peer's public website for indicator updates every 30 minutes.
   • CHave the peer email a daily CSV file of indicators to the SOC distribution list for manual import.
   • DAsk the peer to push indicators to the bank's firewall using the OpenIOC format over SFTP.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a common way SIEM tools integrate threat intelligence?

   • ABy encrypting all stored logs
   • BBy replacing the firewall
   • CBy managing user identities
   • DBy correlating logs with known IOCs to generate alerts
   Reveal Solution Discussion Select an answer first