Threat Intelligence CSA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A SOC analyst is reviewing detection rules and notices that a rule based on a specific file hash is generating a high number of alerts. The hash is from a known malware sample, but the analyst finds that the hash is also present in several legitimate software updates. What should the analyst do to improve the detection rule?

   • ARemove the hash-based rule entirely and rely on behavioral analytics.
   • BReplace the file hash with the malware's domain name as the primary indicator.
   • CKeep the rule as is and accept the high number of alerts as a necessary trade-off.
   • DRefine the rule to include additional context, such as the file's path, digital signature, or parent process, to reduce false positives.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which type of threat intelligence is most likely to be consumed by executive leadership to support high-level business decisions?

   • ATactical threat intelligence
   • BOperational threat intelligence
   • CStrategic threat intelligence
   • DTechnical threat intelligence
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A SOC team is establishing a threat intelligence program. They have limited resources and need to prioritize their efforts. The team has identified several sources of intelligence, but cannot process all of them. Which approach best aligns with the threat intelligence lifecycle to ensure the program is effective?

   • AShare all collected intelligence immediately, regardless of its relevance.
   • BCollect as much data as possible from all sources, then process it all to ensure nothing is missed.
   • CFocus on processing and analysis, and ignore the planning stage to save time.
   • DDefine the intelligence requirements first, then select sources that meet those requirements, and process the data accordingly.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A SOC analyst is building a threat intelligence dashboard for the management team. The dashboard should provide a high-level overview of the threat landscape relevant to the company's industry. Which type of threat intelligence should the analyst include in this dashboard?

   • AStrategic intelligence, such as threat actor motivations and industry trends.
   • BTactical intelligence, such as TTPs used by threat actors.
   • COperational intelligence, such as specific campaigns and attack timelines.
   • DTechnical intelligence, such as malware hashes and C2 domains.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which statement best describes the difference between threat intelligence and raw threat data?

   • AThreat data is always more accurate than threat intelligence
   • BThreat intelligence is only collected from commercial sources, while threat data comes from open sources
   • CThreat data is used only for detection, while threat intelligence is used only for reporting
   • DThreat intelligence is raw data that has been processed and analyzed to provide actionable insight
   Reveal Solution Discussion Select an answer first