Threat Prediction with Cyber Threat Intelligence CND Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company has a SIEM, IDS/IPS, and EDR. They receive a threat feed with IoCs that include hashes, domains, and IPs. The team wants to ensure that the most reliable IoCs are used for blocking, while others are used for alerting. They also need to share relevant findings with a partner organization. What is the best approach?

   • AManually review each IoC and then decide on blocking or alerting, and share only after approval.
   • BUse only the SIEM for all IoCs and do not block anything automatically.
   • CBlock all IoCs in the IDS/IPS and EDR, and share the raw feed with the partner.
   • DConfigure the IDS/IPS and EDR to block on high-confidence IoCs, the SIEM to alert on all IoCs, and share a sanitized summary with the partner.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security analyst notices a pattern of reconnaissance from IPs that are listed in a commercial feed as associated with a known APT group. The analyst wants to predict the group's next likely action and prepare defenses. Which combination of data would provide the most reliable prediction?

   • ACorrelate the APT group's TTPs from the feed with internal vulnerability scans and recent phishing attempts.
   • BBlock all IPs from the feed and assume the threat is neutralized.
   • CUse only the feed's IP list to predict the next target.
   • DWait for the group to launch a full attack before taking action.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A network defender wants to collect intelligence about new malware targeting their industry without exposing production systems. They have a limited budget and need to gather both automated samples and human-validated reports. Which collection strategy best meets these needs?

   • ADeploy a honeypot in a DMZ and subscribe to a commercial threat intelligence feed.
   • BConnect the production network to a dark web monitoring service and rely on its alerts.
   • CSet up a public website to attract attackers and manually record all interactions.
   • DUse only open-source intelligence from social media and forums.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is an example of a threat intelligence sharing community?

   • AISAC (Information Sharing and Analysis Center)
   • BA company's internal HR department
   • CA social media group for gamers
   • DA local book club
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which proactive measure can be taken based on threat intelligence predictions?

   • ADisabling the firewall to improve performance
   • BStrengthening defenses against predicted attack vectors
   • CDeleting all logs to reduce data
   • DWaiting for an attack to occur before acting
   Reveal Solution Discussion Select an answer first