Threat Intelligence CSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC manager needs to brief the executive board on the likelihood of a specific threat actor targeting the company's industry. The briefing must include the actor's motivations, typical targets, and the potential business impact. Which type of threat intelligence should the SOC manager primarily use for this briefing?

   • ATechnical intelligence, such as malware hashes and C2 domains associated with the actor.
   • BStrategic intelligence, providing analysis of the actor's intent, capabilities, and potential impact on the business.
   • CTactical intelligence, detailing the actor's TTPs and specific tools used in campaigns.
   • DOperational intelligence, focusing on specific campaigns and the timing of attacks.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does a threat intelligence feed enhance detection in a SIEM?

   • ABy correlating incoming events with known malicious indicators from the feed
   • BBy providing a user interface for analysts to manually search for threats
   • CBy replacing the need for correlation rules
   • DBy automatically blocking all traffic from IPs in the feed
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC team wants to integrate threat intelligence feeds into their IDS/IPS to block traffic to known malicious IPs. However, they are concerned about the performance impact of checking every packet against a large feed. What is the most effective way to integrate the feed while minimizing performance impact?

   • ALoad the entire feed into the IDS/IPS and enable blocking for all indicators.
   • BDisable the IDS/IPS and rely solely on the SIEM for detection.
   • CUse the feed to create a blocklist that is updated periodically and applied at the firewall level.
   • DOnly use the feed for alerting, not blocking, to avoid performance issues.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is reviewing a threat intelligence report that lists a set of IP addresses associated with a command-and-control (C2) infrastructure. The analyst wants to determine if any internal hosts have communicated with these IPs in the past 30 days. Which approach is most efficient for this analysis?

   • AManually check each IP address against the firewall logs.
   • BUse the SIEM to query for any network connections to the listed IPs within the specified timeframe.
   • CSubmit the IPs to a public sandbox for analysis.
   • DBlock the IPs at the firewall and wait for alerts.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC analyst is explaining the value of threat intelligence to a new team member. The analyst wants to emphasize how threat intelligence supports proactive threat detection. Which statement best describes this role?

   • AThreat intelligence is only useful for large enterprises with dedicated security teams.
   • BThreat intelligence is a one-time process that is completed when the initial assessment is done.
   • CThreat intelligence is primarily used for post-incident analysis to understand what happened.
   • DThreat intelligence helps identify potential threats before they occur by providing context and indicators that can be used to strengthen defenses.
   Reveal Solution Discussion Select an answer first