Threat Intelligence in SOC Operations, Incident Response, and Risk Management CTIA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A threat hunter wants to proactively search for signs of a newly discovered APT group that is known to use living-off-the-land binaries (LOLBins) and PowerShell. The hunter has access to the threat intelligence feed that provides the group's TTPs. What should the hunter do first to formulate a hunting hypothesis?

   • ARun a full packet capture analysis to look for any suspicious network traffic.
   • BAsk the SOC for a list of all alerts from the past week and review them manually.
   • CCreate a hypothesis based on the APT's TTPs, such as looking for PowerShell execution with specific command-line patterns or LOLBin usage on critical assets.
   • DSearch for any process execution of PowerShell in the last 30 days.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   During which phase of the incident response lifecycle does threat intelligence primarily help identify the likely adversary and their motivations?

   • ADetection and Analysis
   • BPreparation
   • CContainment, Eradication, and Recovery
   • DPost-Incident Activity
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which metric is most appropriate for measuring the impact of threat intelligence on incident response?

   • AMean time to respond (MTTR) to incidents that involved intelligence
   • BNumber of intelligence reports published per year
   • CTotal storage capacity of the SIEM
   • DNumber of employees in the SOC
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC manager wants to measure the effectiveness of threat intelligence in reducing alert fatigue and improving triage. Which metric is most directly aligned with this goal?

   • ATotal number of threat intelligence feeds subscribed to by the organization.
   • BPercentage of alerts that were enriched or suppressed by threat intelligence before reaching an analyst.
   • CTime spent by analysts manually searching for threat intelligence during investigations.
   • DNumber of threat intelligence reports published by the team each month.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization is updating its risk scoring model. Threat intelligence indicates that a specific vulnerability is being actively exploited in the wild, and the organization has several assets with that vulnerability. How should the risk team adjust the risk scores for those assets?

   • ADecrease the risk scores because the vulnerability is now well-known and defenses are likely in place.
   • BSet the risk scores to the maximum for all assets with the vulnerability, regardless of exposure.
   • CIncrease the risk scores for all assets with the actively exploited vulnerability to reflect the higher likelihood of compromise.
   • DKeep the risk scores unchanged because the vulnerability is already known.
   Reveal Solution Discussion Select an answer first