Threat Intelligence CSA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In the threat intelligence lifecycle, what is the primary purpose of the 'Planning and Direction' stage?

   • ATo define the intelligence requirements and objectives that guide the entire process
   • BTo collect raw data from all available sources without filtering
   • CTo distribute finished intelligence products to all stakeholders
   • DTo evaluate the effectiveness of the intelligence process after implementation
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which stage of the threat intelligence lifecycle involves converting raw data into a form that can be understood by analysts?

   • ADissemination
   • BAnalysis
   • CCollection
   • DProcessing
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary benefit of integrating threat intelligence into a SIEM?

   • AIt enriches alerts with contextual information about threats
   • BIt eliminates the need for security analysts
   • CIt reduces the volume of logs that need to be stored
   • DIt allows the SIEM to automatically remediate all incidents
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An analyst is reviewing a suspicious email that bypassed the spam filter. The email contains a link to a domain that has not been seen before. The analyst wants to check if this domain is malicious using the SIEM. Which type of IoC would be most directly useful for querying the SIEM?

   • AThe email subject line, which can be searched in email logs.
   • BThe domain name, which can be queried against DNS logs and proxy logs in the SIEM.
   • CThe email sender's IP address, which can be checked against firewall logs.
   • DThe file hash of the email attachment, which can be checked against endpoint logs.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SOC team is evaluating two threat intelligence feeds. Feed A provides a high volume of IoCs but has a high false positive rate. Feed B provides a lower volume but highly curated IoCs with low false positives. The team wants to reduce alert fatigue while maintaining good detection coverage. Which approach is most effective?

   • AUse both feeds equally for automated alerts to get the best of both worlds.
   • BUse Feed A as the primary source for automated alerts to maximize coverage.
   • CUse Feed B as the primary source for automated alerts, and use Feed A for manual threat hunting.
   • DUse Feed B exclusively and ignore Feed A entirely.
   Reveal Solution Discussion Select an answer first