Threat Intelligence CSA Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the primary purpose of threat intelligence sharing?

   • ATo replace the need for internal security monitoring
   • BTo improve collective defense by enabling organizations to learn from each other's threats
   • CTo sell threat data to other organizations for profit
   • DTo comply with all international privacy regulations
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A SOC manager is allocating budget for threat intelligence. The team needs to support both long-term strategic planning for the board and daily detection operations. The budget is limited, so the manager must choose a single primary source. Which approach best balances the need for both strategic and technical intelligence?

   • AInvest in an internal threat intelligence team to produce all intelligence in-house.
   • BPurchase a single-purpose feed that only provides IoCs for immediate detection.
   • CSubscribe to a commercial threat intelligence service that provides both executive-level reports and technical feeds.
   • DRely solely on free open-source intelligence feeds for technical indicators.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A SOC analyst has identified a new malware variant that is not yet widely known. The analyst wants to share this intelligence with other organizations in a structured format that can be automatically consumed by their security tools. Which approach is most appropriate?

   • ACreate a PDF report and upload it to the company's internal wiki.
   • BSend an email with the IoCs to a mailing list of known analysts.
   • CPublish the IoCs and TTPs using STIX and share them via a TAXII server.
   • DPost the details on a public forum and hope other analysts see it.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following is an example of an open-source threat intelligence source?

   • AA publicly accessible security blog that publishes analysis of recent malware campaigns
   • BA threat intelligence report shared only among members of a closed industry group
   • CInternal DNS logs from the organization's own servers
   • DA vendor-specific threat feed that requires a paid subscription
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A SOC team is considering joining a threat intelligence sharing community. They are concerned about the sensitivity of sharing their own internal IoCs with external partners. The team wants to share indicators that are useful to others without exposing sensitive internal network details. What is the most appropriate approach?

   • ARefuse to share any indicators to avoid any risk of exposure.
   • BShare only external-facing indicators, such as malicious domains, IPs, and file hashes, while omitting internal network information.
   • CShare all internal IoCs, including internal IP addresses and hostnames, to provide maximum value to partners.
   • DShare only the names of threat actors without any technical indicators.
   Reveal Solution Discussion Select an answer first