Threat Intelligence in SOC Operations, Incident Response, and Risk Management CTIA Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   An organization is enhancing its risk scoring model for assets. Threat intelligence indicates that a particular asset is frequently targeted by a specific adversary group and has a known vulnerability. The risk team wants to incorporate this intelligence into the scoring model. Which approach best reflects the use of threat intelligence in risk scoring?

   • AIncrease the risk score for the asset based on the threat intelligence about the adversary's targeting and the known vulnerability.
   • BSet the risk score to the maximum possible value for any asset mentioned in threat intelligence.
   • CKeep the risk score unchanged because threat intelligence is not a reliable input for risk scoring.
   • DDecrease the risk score because the asset is already known to be targeted, so the risk is already priced in.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   When using threat intelligence to inform risk treatment decisions, which action is most directly supported?

   • APrioritizing which vulnerabilities to patch first based on active exploitation
   • BIncreasing the marketing budget
   • CDeleting all logs older than 30 days
   • DChanging the organization's legal structure
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A SOC analyst notices that the SIEM is generating a high volume of alerts for a known commodity malware family. The threat intelligence feed provides indicators of compromise (IOCs) for this family, but the SIEM correlation rules are not using them. The SOC manager wants to reduce alert fatigue without missing genuine infections. Which action should the SOC take first?

   • ACreate a SIEM correlation rule that enriches incoming alerts with the threat intelligence feed and suppresses alerts for IOCs that are also present in the feed.
   • BDisable the SIEM correlation rules for the commodity malware family and rely on the threat intelligence feed for detection.
   • CIncrease the severity of all alerts matching the threat intelligence feed so analysts review them first.
   • DExport the threat intelligence feed to a flat file and manually compare it with SIEM alerts at the end of each shift.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A SOC is designing a new alert triage workflow. The team wants to ensure that alerts are prioritized based on the relevance of the threat intelligence to the organization's environment. The workflow should automatically assign a priority level to each alert. What should the workflow include?

   • AA correlation step that matches alert indicators against the threat intelligence repository and adjusts priority based on the match and asset criticality.
   • BA rule that assigns highest priority to any alert containing an indicator from the threat feed, regardless of asset value.
   • CA manual review step where analysts check the threat intelligence portal for each alert before assigning priority.
   • DA static priority assignment based on the alert type, regardless of threat intelligence context.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A threat hunting team is deciding which hypothesis to pursue. Threat intelligence indicates that a sophisticated adversary has been observed using fileless techniques and abusing Windows Management Instrumentation (WMI) for persistence. The team has limited time and must choose a hunt that is both effective and efficient. Which hypothesis is best?

   • AHunt for any fileless malware by scanning memory for known signatures.
   • BHunt for all processes running from unusual paths, regardless of WMI.
   • CHunt for indicators of compromise from the threat intelligence feed, such as IP addresses and domains.
   • DHunt for unusual WMI activity, such as remote WMI connections or WMI event subscriptions, which are common persistence mechanisms.
   Reveal Solution Discussion Select an answer first