Threat Intelligence CSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC analyst is reviewing a threat intelligence report that describes a new attack campaign. The report includes the TTPs used by the attackers, the specific tools they employ, and the indicators of compromise. The analyst needs to determine if the organization is vulnerable to this campaign. Which type of intelligence is most useful for this assessment?

   • AStrategic intelligence, which provides a high-level overview of the threat landscape.
   • BTactical intelligence, which provides details on the attackers' TTPs and tools.
   • COperational intelligence, which provides details on specific campaigns and their targets.
   • DTechnical intelligence, which provides specific IoCs like hashes and IPs.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the role of TAXII in threat intelligence sharing?

   • AIt is a protocol for exchanging threat intelligence over HTTPS
   • BIt is a database for storing threat intelligence
   • CIt is a standard format for representing threat intelligence data
   • DIt is a tool for analyzing malware samples
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC team is establishing a threat intelligence program. They have limited resources and need to decide which sources to prioritize. The team has identified a commercial feed, an open-source feed, and internal telemetry. They want to maximize the value of their intelligence while minimizing the effort required to process it. What is the most effective strategy?

   • AIntegrate all three sources, but use automation to process and correlate the data to reduce manual effort.
   • BPrioritize internal telemetry because it provides the most relevant intelligence for the company's environment.
   • CPrioritize the commercial feed because it is curated and has high confidence indicators.
   • DPrioritize the open-source feed because it is free and has a broad range of indicators.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC team is implementing a new threat intelligence program. After collecting data from various sources, they have identified a new phishing campaign targeting their industry. They need to ensure the intelligence is used to update detection rules and that the process is continuously improved. Which step of the threat intelligence lifecycle is most critical to ensure the program remains effective?

   • AFeedback, where the effectiveness of the detection rules is reviewed and lessons learned are incorporated into the next cycle.
   • BCollection, where as much data as possible is gathered from all sources.
   • CProcessing, where raw data is converted into a usable format.
   • DDissemination, where the intelligence is shared with the relevant teams.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC analyst is reviewing a threat intelligence report that includes a list of malicious IP addresses. The analyst wants to check if any of these IPs have been observed in the company's proxy logs. Which approach is most efficient?

   • ABlock the IPs at the firewall and monitor for alerts.
   • BUse the SIEM to query the proxy logs for any of the listed IPs.
   • CSubmit the IPs to a threat intelligence platform for enrichment.
   • DManually search the proxy logs for each IP address.
   Reveal Solution Discussion Select an answer first