Threat Prediction with Cyber Threat Intelligence CND Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A SOC receives a high volume of IoCs from multiple threat intelligence feeds. The team is overwhelmed by alerts and has started ignoring many of them. The SOC manager wants to improve the signal-to-noise ratio without losing critical detections. Which approach is most effective?

   • AIncrease the number of feeds to get more coverage
   • BApply a risk-based scoring model to prioritize IoCs based on relevance to the organization
   • CDisable all alerts from external feeds
   • DAutomatically block all IPs from the feeds
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A threat intelligence analyst has produced a detailed report on a new attack campaign. The report includes technical IoCs, affected systems, and recommended mitigations. Which audience would benefit most from the full technical report?

   • AThe executive leadership team
   • BThe human resources department
   • CThe legal department
   • DThe security operations center (SOC) analysts
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   After analyzing a new malware campaign, a threat intelligence analyst must share findings with different audiences. The executive team needs a risk summary, the SOC needs technical IoCs, and the IT helpdesk needs user-awareness guidance. What is the most effective dissemination approach?

   • APublish the IoCs to the SIEM and email a link to the full report to everyone
   • BCreate tailored briefings: executive summary, technical IoC bulletin, and user awareness notice
   • CSend one detailed technical report to all stakeholders
   • DPost the raw intelligence on the company intranet for all employees
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following is an example of an open-source threat intelligence feed?

   • AA threat report shared only within a closed industry group
   • BInternal logs from an organization's firewall
   • CA publicly available feed from a security research group
   • DA commercial subscription to a vendor's threat database
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An analyst has collected thousands of IoCs from multiple feeds. Many are duplicates or false positives. The analyst needs to identify which IoCs are most relevant to their environment and likely to indicate a real threat. What is the best analytical approach?

   • AEnrich the IoCs with context from internal logs and prioritize those that match observed network behavior.
   • BSelect the IoCs from the most expensive feed and ignore the rest.
   • CUse all IoCs in the SIEM and generate alerts for every match.
   • DDelete all IoCs that do not have a known malware family associated.
   Reveal Solution Discussion Select an answer first