Threat Intelligence in SOC Operations, Incident Response, and Risk Management CTIA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A risk manager is updating the organization's risk register and wants to incorporate threat intelligence to better prioritize risks. The organization has a mature SOC and IR team, but the risk team currently relies on generic vulnerability scans. The risk manager needs a defensible method to adjust risk scores based on current threat activity. What should the risk manager do?

   • AReplace the vulnerability-based risk scores with threat intelligence severity ratings from the latest feed.
   • BUse threat intelligence to adjust the likelihood and impact ratings of existing risks, and document the rationale for each adjustment.
   • CAsk the SOC to provide a list of the top 10 threats and assign those as the top risks in the register.
   • DIncrease all risk scores by a fixed percentage when the threat feed indicates a high global threat level.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which metric would best measure the effectiveness of threat intelligence in reducing alert fatigue in a SOC?

   • APercentage reduction in false positive alerts after intelligence integration
   • BNumber of threat intelligence feeds subscribed to
   • CTotal number of security tools deployed
   • DTime spent in meetings discussing threats
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC analyst is triaging a queue of alerts. The threat intelligence feed indicates that a specific malware family is actively targeting the organization's industry. One alert matches an IOC for this malware on a low-value asset, while another alert is for a generic phishing attempt on a domain controller. How should the analyst prioritize?

   • AEscalate both alerts to the IR team without further triage.
   • BPrioritize the malware alert because it matches the active threat intelligence, regardless of the asset.
   • CHandle both alerts at the same time because they are equally important.
   • DPrioritize the phishing alert because the domain controller is a critical asset, and the malware alert is on a low-value asset.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a key consideration when operationalizing threat intelligence in a SOC?

   • ASharing all intelligence publicly without restrictions
   • BStoring intelligence in a static document that is rarely updated
   • CEnsuring the intelligence is timely, relevant, and actionable for the organization's environment
   • DCollecting as much intelligence as possible without filtering
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During a major incident, the SOC, incident response, and risk management teams are working separately. The SOC has identified a new indicator, but the IR team is not aware of it, and the risk team is not updating the risk register. Which action best improves collaboration among these teams?

   • AWait until the incident is over to share all intelligence in a final report.
   • BEstablish a real-time intelligence sharing channel (e.g., a dedicated chat or ticketing queue) that all three teams monitor and update during the incident.
   • CHave the SOC handle the incident alone and inform the other teams only if the incident escalates.
   • DAsk the risk team to take over the incident response because they have the overall risk picture.
   Reveal Solution Discussion Select an answer first