Threat Intelligence CSA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A SOC analyst is building a threat intelligence program and needs to prioritize sources. The analyst has access to a commercial feed with high confidence indicators, an open-source feed with a broad range of indicators, and internal telemetry from the company's own network. Which source should be considered the most authoritative for detecting threats specific to the company's environment?

   • AThe commercial feed, because it has high confidence indicators.
   • BInternal telemetry, because it provides direct visibility into the company's own network and endpoints.
   • CAll sources are equally authoritative and should be used interchangeably.
   • DThe open-source feed, because it has a broad range of indicators.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC analyst is tuning the SIEM to reduce false positives from a commercial threat intelligence feed. The feed includes a large volume of IP reputation data, but the analyst notices that many alerts fire for internal IP addresses that are being flagged by the feed. The analyst needs to ensure that only external IP addresses are checked against the feed while still maintaining detection for internal hosts communicating with known-bad external IPs. What is the most effective approach?

   • AConfigure the SIEM correlation rule to only match the source IP field against the threat intelligence feed when the destination IP is external.
   • BCreate a SIEM correlation rule that checks the destination IP field against the threat intelligence feed and excludes any events where the destination IP is in the internal network range.
   • CDisable the threat intelligence feed for all correlation rules and rely on the IDS/IPS to handle external IP reputation checks.
   • DAdd all internal IP addresses to a whitelist in the threat intelligence feed provider's portal so the feed no longer includes them.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which analytical method is used to identify relationships between seemingly unrelated indicators or events?

   • ALink analysis
   • BVulnerability scanning
   • CData normalization
   • DLog aggregation
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An analyst is reviewing a threat intelligence report that includes a new malware family. The report provides the malware's hash, C2 domains, and a description of its behavior. The analyst needs to create a detection rule. Which combination of intelligence is most effective for creating a robust detection rule?

   • AUse only the hash to create a rule that matches the exact file.
   • BUse the hash and domains, but ignore the behavioral description.
   • CUse only the C2 domains to create a rule that alerts on network connections.
   • DUse the behavioral description to create a rule that detects the malware's actions, and use the hashes and domains as additional indicators.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC analyst is investigating a potential insider threat. They need to understand the normal behavior of a specific user to identify anomalies. Which source of threat intelligence would be most valuable for this investigation?

   • AOpen-source intelligence from public forums and social media.
   • BCommercial intelligence from a threat feed provider.
   • CInternal intelligence from the organization's own logs, such as user activity and access patterns.
   • DGovernment intelligence from national CERT alerts.
   Reveal Solution Discussion Select an answer first