A SOC analyst is explaining to a new team member why threat intelligence is important for proactive threat detection. The analyst wants to emphasize how intelligence helps the team anticipate attacks rather than just react to them. Which statement best illustrates this proactive benefit?

Threat intelligence automates the response to all security incidents without human intervention.

Threat intelligence helps the team understand the root cause of an attack after it has occurred.

Threat intelligence allows the team to identify and block known malicious indicators before they are used in an attack.

Threat intelligence provides a historical record of past attacks for compliance purposes.

Why are file hashes considered a reliable type of IoC for detecting known malware?

They are based on the file's name and location

They are easy for attackers to change without altering the file

They are the same for all files from the same malware family

They are unique to a specific file and do not change unless the file content changes

A SOC analyst has discovered a new zero-day vulnerability being exploited in the wild. The analyst wants to share this information with other organizations quickly, but is concerned about the vulnerability being exploited further before patches are available. What is the most responsible way to share this intelligence?

Publish the full technical details on a public blog to warn everyone immediately.

Share the technical details and IoCs with a trusted information sharing and analysis center (ISAC) using STIX/TAXII.

Share the information only with vendors who can develop patches, but not with other organizations.

Keep the information confidential until a patch is available, sharing it with no one.

A SOC analyst is creating a detection rule for a new malware campaign. The analyst has a malicious file hash, a C2 domain, and a specific user-agent string used by the malware. Which indicator is the most reliable for detecting the malware across different environments?

A combination of all three indicators in a correlation rule.

The C2 domain, because it is required for the malware to communicate.

The user-agent string, because it is a behavioral indicator that is harder to change.

The file hash, because it is unique to the specific malware sample.

An organization's SOC wants to incorporate threat intelligence that reflects its own network environment and past incidents. Which type of source would best provide this?

Information-sharing communities like ISACs

Internal sources such as SIEM logs, firewall logs, and incident reports

Commercial feeds from a third-party vendor

Open-source intelligence from public OSINT repositories

EC-CouncilCertified SOC Analyst

Domain 5Objective 1

Threat Intelligence CSA Practice Questions (Page 2)

Part of the Proactive Threat Detection domain, which makes up ~14% of our current practice bank.

51questions here

11free pages

10concepts

Questions 6–10

6application · medium
A SOC analyst is explaining to a new team member why threat intelligence is important for proactive threat detection. The analyst wants to emphasize how intelligence helps the team anticipate attacks rather than just react to them. Which statement best illustrates this proactive benefit?
Select an answer first
7foundation · easy
Why are file hashes considered a reliable type of IoC for detecting known malware?
Select an answer first
8expert · hard
A SOC analyst has discovered a new zero-day vulnerability being exploited in the wild. The analyst wants to share this information with other organizations quickly, but is concerned about the vulnerability being exploited further before patches are available. What is the most responsible way to share this intelligence?
Select an answer first
9application · medium
A SOC analyst is creating a detection rule for a new malware campaign. The analyst has a malicious file hash, a C2 domain, and a specific user-agent string used by the malware. Which indicator is the most reliable for detecting the malware across different environments?
Select an answer first
10foundation · easy
An organization's SOC wants to incorporate threat intelligence that reflects its own network environment and past incidents. Which type of source would best provide this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.