Threat Intelligence in SOC Operations, Incident Response, and Risk Management CTIA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A threat hunter is planning a hunt for a new APT group that is known to use fileless techniques and abuse Windows Management Instrumentation (WMI). The hunter has access to the threat intelligence feed with the group's TTPs. The organization has a limited logging budget and cannot enable all possible data sources. What should the hunter do to maximize the chance of detecting the APT?

   • AEnable all possible logging sources for a week to capture the APT's activity.
   • BEnable PowerShell logging on all endpoints and search for any PowerShell execution.
   • CEnable WMI logging on all endpoints and search for WMI activity on critical assets.
   • DEnable network logging and look for any outbound connections to unknown IPs.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization has a threat intelligence platform (TIP) but the SOC and IR teams are not updating it with new indicators discovered during incidents. The CTI lead wants to ensure that all teams contribute to the shared repository. What should the CTI lead implement?

   • AA monthly email reminder to all teams to update the TIP.
   • BA new SIEM rule that automatically adds all alert indicators to the TIP.
   • CA formal process that requires incident responders to submit new indicators to the TIP as part of the incident closure checklist.
   • DA policy that only the CTI lead can update the TIP.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   When prioritizing mitigation strategies, threat intelligence is most useful for:

   • AIdentifying all software vulnerabilities in the environment
   • BDetermining which vulnerabilities are most likely to be exploited by active threat actors
   • CCalculating the exact cost of a data breach
   • DEnsuring compliance with all regulatory requirements
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization wants to implement a process for sharing threat intelligence with external partners (e.g., industry peers and ISACs). The SOC is concerned about sensitive information leakage. Which process best balances sharing and confidentiality?

   • AUse a traffic light protocol (TLP) to classify information and share only indicators that are marked as appropriate for external distribution.
   • BRefuse to share any intelligence externally to avoid any risk.
   • CShare only after the incident is fully resolved and all data is anonymized.
   • DShare all threat intelligence without classification to maximize collaboration.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An organization has multiple threat intelligence feeds, but the SOC and IR teams are not consistently using them. Some analysts rely on one feed, others on another, and there is no central repository. The CTI lead wants to establish a process for consuming, sharing, and updating threat intelligence. What should the CTI lead implement first?

   • AA new SIEM rule that pulls indicators from all feeds directly into the SIEM.
   • BA weekly meeting where analysts share the intelligence they have collected manually.
   • CA policy that requires all analysts to use the same feed, without changing the current tools.
   • DA central threat intelligence platform (TIP) that aggregates feeds and provides a single source of truth for all teams.
   Reveal Solution Discussion Select an answer first