Threat Intelligence in SOC Operations, Incident Response, and Risk Management CTIA Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A SOC analyst is triaging a queue of alerts. The threat intelligence feed indicates that a specific malware campaign is currently targeting the organization's sector, and one of the alerts matches an indicator from that campaign. Other alerts are for generic phishing attempts. How should the analyst prioritize the alerts?

   • ATreat all alerts with equal priority to avoid bias.
   • BPrioritize the alert matching the active campaign indicator because it aligns with current threat intelligence and sector-specific relevance.
   • CPrioritize alerts that do not match any threat intelligence because they are more suspicious.
   • DPrioritize the generic phishing alerts because they are more common.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Why is collaboration between SOC, IR, and risk management teams important for threat intelligence utilization?

   • AIt guarantees that all incidents are prevented
   • BIt reduces the need for security monitoring
   • CIt eliminates the need for threat intelligence platforms
   • DIt ensures that intelligence is shared and applied consistently across detection, response, and risk decisions
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A SOC is designing a workflow for alert triage. The workflow should automatically enrich alerts with threat intelligence and then route them to the appropriate queue based on severity. Which workflow step is most critical to ensure the enrichment is effective?

   • AUse only one threat intelligence feed to avoid conflicts.
   • BManually review every alert before enrichment to ensure accuracy.
   • CRoute all alerts to the same queue regardless of enrichment results.
   • DEnsure the threat intelligence feed is continuously updated and validated to maintain accuracy.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   An organization is in the lessons learned phase of an incident. The IR team found that the threat intelligence feed had indicators for the attacker's infrastructure, but the SOC did not use them because the feed was not integrated into the SIEM. The risk team also wants to update the risk register. What should the organization do to prevent this from recurring?

   • ADiscontinue the threat intelligence feed because it was not useful.
   • BDocument the gap in the lessons learned report and create an action item to integrate the threat intelligence feed into the SIEM.
   • CBlame the SOC analysts for not manually checking the feed and require them to do so in the future.
   • DUpdate the risk register to note that the incident was caused by the threat intelligence feed being inadequate.
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A threat hunting team is planning a proactive hunt. Threat intelligence reports indicate that a specific adversary group has been using living-off-the-land binaries (LOLBins) and PowerShell scripts to evade detection. The team has limited time and must choose a hunting hypothesis. Which hypothesis is most aligned with the intelligence and likely to yield results?

   • AHunt for malware signatures from the threat intelligence feed, ignoring LOLBins and PowerShell.
   • BHunt for anomalies in user login times, as the adversary is likely to operate outside business hours.
   • CHunt for unusual PowerShell execution patterns and use of known LOLBins in the environment, correlating with recent network connections to suspicious external IPs.
   • DHunt for any use of PowerShell, regardless of context, because the adversary is known to use it.
   Reveal Solution Discussion Select an answer first