Which security tool is most commonly integrated with threat intelligence to automatically block traffic from known malicious IP addresses?

Intrusion Prevention System (IPS)

A SOC team wants to share indicators of compromise with partner organizations in a standardized, machine-readable format. They also want to automate the exchange of these indicators with a trusted community platform. Which combination of standards and protocols should they implement?

TAXII for the data format and STIX for the transport mechanism.

STIX for the data format and TAXII for the transport mechanism.

OpenIOC for the data format and REST API for the transport mechanism.

CSV for the data format and email for the transport mechanism.

What is the primary purpose of threat intelligence in a SOC environment?

To automate all incident response actions without human intervention

To provide a historical record of past security incidents for compliance reporting

To enable proactive detection and informed decision-making by providing context about threats

To replace the need for traditional signature-based antivirus solutions

A SOC analyst is tuning the SIEM to reduce false positives on a new malware campaign. The team has a commercial threat feed that provides SHA256 hashes of known malicious files, but the SIEM currently only ingests Windows Event Logs. Which action would best leverage the feed to improve detection?

Create a correlation rule that matches file hash values from the feed against hash values computed from executable files observed in the environment.

Configure the SIEM to block all network connections to IP addresses listed in the feed.

Manually review each hash in the feed and create a separate alert for every file name associated with it.

Upload the hash list to the IDS/IPS as a custom signature to match against network traffic.

What is the primary benefit of using threat intelligence to identify emerging threats?

It automatically patches all vulnerabilities

It allows the SOC to detect new threats before they are widely known

It eliminates the need for incident response

It guarantees that no security breach will occur

EC-CouncilCertified SOC Analyst

Domain 5Objective 1

Threat Intelligence CSA Practice Questions (Page 5)

Part of the Proactive Threat Detection domain, which makes up ~14% of our current practice bank.

51questions here

11free pages

10concepts

Questions 21–25

21foundation · easy
Which security tool is most commonly integrated with threat intelligence to automatically block traffic from known malicious IP addresses?
Select an answer first
22application · medium
A SOC team wants to share indicators of compromise with partner organizations in a standardized, machine-readable format. They also want to automate the exchange of these indicators with a trusted community platform. Which combination of standards and protocols should they implement?
Select an answer first
23foundation · easy
What is the primary purpose of threat intelligence in a SOC environment?
Select an answer first
24application · medium
A SOC analyst is tuning the SIEM to reduce false positives on a new malware campaign. The team has a commercial threat feed that provides SHA256 hashes of known malicious files, but the SIEM currently only ingests Windows Event Logs. Which action would best leverage the feed to improve detection?
Select an answer first
25foundation · easy
What is the primary benefit of using threat intelligence to identify emerging threats?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.