Threat Intelligence CSA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of an indicator of compromise (IoC) that can be used to detect a specific malware infection?

   • AThe version number of the SIEM software
   • BThe organization's public IP address
   • CThe MD5 hash of a known malicious executable
   • DThe name of the CEO of the organization
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A SOC team has integrated a threat intelligence feed into their SIEM. The feed includes IoCs for a specific campaign. However, the team is seeing a high number of false positives because the IoCs are too broad (e.g., a shared hosting IP address). What is the most effective way to reduce false positives while maintaining detection capability?

   • ARemove the broad IoCs from the feed and rely only on more specific indicators.
   • BDisable the alerts for these IoCs and only use them for manual threat hunting.
   • CIncrease the severity of the alerts for these IoCs to ensure they are not missed.
   • DAdd context to the IoCs, such as correlating them with other indicators like specific user agents or file hashes, before generating an alert.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC team wants to automatically block traffic to known malicious IP addresses at the network perimeter. They have a threat intelligence feed with a list of malicious IPs. Which security tool should they integrate the feed with to achieve this?

   • AThe endpoint detection and response (EDR) solution, which can block processes but not network traffic.
   • BThe firewall or intrusion prevention system (IPS), which can enforce blocking rules based on the feed.
   • CThe vulnerability scanner, which can identify weaknesses but not block traffic.
   • DThe SIEM, which can alert on traffic to the IPs but cannot block it.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of a threat intelligence feed in a SOC?

   • ATo provide a backup of the organization's critical data
   • BTo automatically patch all vulnerabilities in the network
   • CTo provide a continuous stream of indicators and context that can be used to enrich security monitoring
   • DTo replace the need for log management and SIEM tools
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which type of threat intelligence is primarily composed of indicators of compromise (IoCs) such as IP addresses, hashes, and domains?

   • ATactical intelligence
   • BOperational intelligence
   • CStrategic intelligence
   • DTechnical intelligence
   Reveal Solution Discussion Select an answer first