Threat Prediction with Cyber Threat Intelligence CND Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team has a SIEM and an EDR. They receive a threat feed with a mix of low-confidence and high-confidence IoCs. The team wants to minimize false positives while ensuring that high-confidence indicators are immediately blocked. Which approach best balances detection and operational impact?

   • AUse all IoCs only as SIEM alerts and never block automatically.
   • BManually review every IoC before deciding to block or alert.
   • CAutomatically block high-confidence IoCs in the EDR and use low-confidence IoCs as SIEM alerts for investigation.
   • DBlock all IoCs in the EDR regardless of confidence to ensure maximum security.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst at a mid-sized company needs to detect early signs of a new ransomware campaign that is targeting their industry. The analyst has limited budget and wants to supplement internal telemetry with external indicators. Which combination of sources would provide the most cost-effective and timely coverage?

   • AMonitor open-source intelligence (OSINT) feeds and participate in an industry information-sharing community
   • BDeploy additional network sensors and rely solely on internal logs
   • CPurchase a commercial feed and integrate it only into the SIEM
   • DSubscribe to a commercial threat intelligence feed and deploy honeypots in the DMZ
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company has identified a new zero-day vulnerability in a widely used software product. The security team wants to share this information with other organizations to help them protect themselves. Which action is most appropriate for responsible threat intelligence sharing?

   • AShare the information with an industry ISAC and the software vendor
   • BKeep the information confidential to avoid panic
   • CPublish the vulnerability details on a public blog immediately
   • DSell the vulnerability details to a commercial threat intelligence vendor
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has detected a new phishing campaign targeting their employees. They want to share this intelligence with other companies in their sector to prevent similar attacks. However, they are concerned about revealing internal email addresses and the specific lure used. What is the best way to share?

   • AShare only with the company's own employees and not externally.
   • BWait for the campaign to end and then share a full report with the media.
   • CPublish the full phishing email on a public blog to warn everyone.
   • DShare the phishing URLs and subject lines with an ISAC, while redacting internal email addresses and employee names.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is part of an ISAC and also subscribes to a commercial threat feed. They have discovered a zero-day vulnerability in a vendor product used by many members. The company wants to share this information to help others, but is concerned about revealing their own exposure and tipping off attackers. What is the most appropriate action?

   • AWait for the vendor to release a patch and then share the information.
   • BShare the vulnerability details with the ISAC under a trusted sharing agreement, including the affected product and mitigation steps, while withholding internal detection specifics.
   • CPublish the vulnerability on a public forum to reach the widest audience.
   • DShare the information only with the commercial feed provider, not with the ISAC.
   Reveal Solution Discussion Select an answer first