How are IoCs primarily used in threat detection?

To replace the need for security monitoring

To match against system and network activity to identify potential compromises

To predict future attacks with absolute certainty

To encrypt sensitive data at rest

A threat intelligence team has identified that a known adversary group is actively targeting organizations in the same sector. The team has limited resources and must decide where to focus defensive efforts. Which action best uses threat prediction to allocate resources?

Wait for the adversary to attack before taking action

Apply the Diamond Model to map the adversary's infrastructure and anticipate their next targets

Deploy additional firewalls at the perimeter

Increase the frequency of vulnerability scans

A SOC has integrated a threat intelligence feed into its SIEM. The feed provides a high volume of IoCs, but the SIEM is generating too many alerts, many of which are false positives. The SOC wants to reduce noise while maintaining detection of relevant threats. Which configuration change is most effective?

Manually review all alerts from the feed

Filter the feed to only include IoCs relevant to the organization's industry and assets

Increase the SIEM correlation rule thresholds

In the threat intelligence lifecycle, what occurs during the 'Analysis' stage?

Intelligence is shared with external partners

Raw data is transformed into actionable intelligence

Intelligence requirements are defined

Data is collected from various sources

EC-CouncilCertified Network Defender

Domain 7Objective 3

Threat Prediction with Cyber Threat Intelligence CND Practice Questions (Page 6)

Part of the Risk and Threat Management domain, which makes up ~16% of our current practice bank.

57questions here

12free pages

10concepts

Questions 26–30

26foundation · easy
How are IoCs primarily used in threat detection?
Select an answer first
27expert · hard
A threat intelligence team has identified that a known adversary group is actively targeting organizations in the same sector. The team has limited resources and must decide where to focus defensive efforts. Which action best uses threat prediction to allocate resources?
Select an answer first
28expert · hard
A SOC has integrated a threat intelligence feed into its SIEM. The feed provides a high volume of IoCs, but the SIEM is generating too many alerts, many of which are false positives. The SOC wants to reduce noise while maintaining detection of relevant threats. Which configuration change is most effective?
Select an answer first
29foundation · easy
What is the first stage of the threat intelligence lifecycle?
Select an answer first
30foundation · easy
In the threat intelligence lifecycle, what occurs during the 'Analysis' stage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.

Threat Prediction with Cyber Threat Intelligence CND Practice Questions (Page 6)

Questions 26–30

How are IoCs primarily used in threat detection?

A threat intelligence team has identified that a known adversary group is actively targeting organizations in the same sector. The team has limited resources and must decide where to focus defensive efforts. Which action best uses threat prediction to allocate resources?

What is the first stage of the threat intelligence lifecycle?

In the threat intelligence lifecycle, what occurs during the 'Analysis' stage?

Keep studying — Risk and Threat Management