Threat Intelligence in SOC Operations, Incident Response, and Risk Management CTIA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How does threat intelligence enhance risk scoring models?

   • ABy providing a static list of all possible threats
   • BBy automatically remediating high-risk vulnerabilities
   • CBy replacing the need for asset criticality assessments
   • DBy incorporating the current threat landscape into the likelihood of exploitation
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC manager wants to measure the effectiveness of the threat intelligence program in improving alert triage and response. The team has implemented intelligence-driven workflows. Which metric would best demonstrate the value of threat intelligence in SOC operations?

   • AThe number of IOCs published to the threat intelligence platform each month.
   • BThe total number of alerts generated per day.
   • CThe number of threat intelligence feeds subscribed to by the organization.
   • DThe percentage of alerts that are enriched with threat intelligence and the reduction in time to triage for those alerts.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How does threat intelligence support risk assessment in an organization?

   • ABy replacing the need for vulnerability scanning
   • BBy automatically eliminating all identified risks
   • CBy guaranteeing that all threats are prevented
   • DBy providing information about current threats that can be used to adjust the likelihood and impact of risks
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC is designing a workflow for alert triage that incorporates threat intelligence. The workflow should automatically assign a priority to each alert based on the relevance of the threat to the organization and the criticality of the affected asset. What is the best way to implement this?

   • AAssign priority based only on the asset criticality score.
   • BAssign priority based only on the threat intelligence relevance score.
   • CUse a scoring matrix that combines the threat intelligence relevance score with the asset criticality score to determine priority.
   • DHave an analyst manually review each alert and assign priority based on their judgment.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During the containment phase of an incident response, the IR team identifies a command-and-control (C2) domain that is unique to the attacker. The team wants to ensure that this intelligence is available for future detection and for other teams in the organization. What is the most appropriate action?

   • AShare the C2 domain with the SOC and update the threat intelligence repository so it can be used in detection rules and future hunts.
   • BOnly share the C2 domain with external partners, not internally.
   • CWait until the lessons learned phase to share the C2 domain with other teams.
   • DAdd the C2 domain to the blocklist and document it in the incident report only.
   Reveal Solution Discussion Select an answer first