Threat Intelligence CSA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   How can threat intelligence be used to enhance detection rules in a SIEM?

   • ABy disabling detection rules that generate false positives
   • BBy replacing all existing detection rules with intelligence feeds
   • CBy encrypting all log data before analysis
   • DBy adding indicators from intelligence feeds as correlation conditions in detection rules
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary goal of threat intelligence analysis?

   • ATo transform raw data into actionable insights that support security decisions
   • BTo distribute intelligence reports to all employees
   • CTo collect as much data as possible from multiple sources
   • DTo store threat data for future reference
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC analyst is explaining the concept of threat intelligence to a new team member. The analyst wants to clarify that threat intelligence is more than just a list of IoCs. Which statement best describes the value of threat intelligence in a SOC?

   • AThreat intelligence is only useful for incident response, not for proactive detection.
   • BThreat intelligence is a collection of malware hashes and IP addresses.
   • CThreat intelligence provides context about threats, enabling the team to prioritize and respond effectively.
   • DThreat intelligence is a one-time activity that does not require continuous updates.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC manager needs to brief the CISO on the overall threat landscape and the potential impact of a new ransomware group on the organization's industry. The CISO wants a high-level overview, not technical details. Which type of threat intelligence is most appropriate for this request?

   • ATactical intelligence, detailing the specific TTPs and tools the ransomware group uses.
   • BStrategic intelligence, summarizing adversary motivations, industry trends, and potential business impact.
   • CTechnical intelligence, listing the exact hashes and C2 domains associated with the group.
   • DOperational intelligence, providing specific campaigns and their technical indicators.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A SOC analyst is investigating a series of alerts triggered by a threat intelligence feed that flags a specific domain as malicious. The analyst discovers that the domain is a legitimate service used by the company's marketing team. The feed's confidence score for this domain is low, but the alert volume is high. The analyst needs to reduce noise without losing the ability to detect real threats. What is the best course of action?

   • AAdjust the SIEM rule to only alert when the domain is accessed from a non-corporate device or outside normal business hours.
   • BDisable the threat intelligence feed entirely to stop the alerts.
   • CIncrease the confidence threshold for all indicators in the feed to reduce alerts.
   • DImmediately block the domain at the firewall to prevent any potential threat.
   Reveal Solution Discussion Select an answer first