Threat Prediction with Cyber Threat Intelligence CND Practice Questions (Page 12)

Questions 56–57

1. 56expert · hard

   A security team has observed a series of small, seemingly unrelated attacks against their network over the past month. Each attack was blocked individually, but the team suspects a coordinated campaign. Which approach would best help predict the next likely action?

   • AWait for the next attack to occur
   • BIncrease the firewall logging level
   • CBlock all IPs that were involved in the attacks
   • DAnalyze the attacks collectively using the Cyber Kill Chain to identify a pattern
   Reveal Solution Discussion Select an answer first
2. 57application · medium

   A company wants to automatically block traffic to known malicious domains and alert on suspicious internal connections. They have a next-generation firewall and a SIEM. Which integration would achieve this goal with the least manual effort?

   • AConfigure the firewall to block all traffic to unknown domains and rely on the SIEM for reporting.
   • BImport threat intelligence feeds into the firewall's URL filtering and configure the SIEM to correlate firewall logs with the same feeds.
   • CManually add each malicious domain to the firewall's block list as they are reported.
   • DUse the SIEM to send alerts for any domain that appears in the logs, and have an analyst verify each one.
   Reveal Solution Discussion Select an answer first