Threat Intelligence in SOC Operations, Incident Response, and Risk Management CTIA Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   In an intelligence-driven SOC workflow, what is the primary role of threat intelligence during alert triage?

   • ATo enrich alerts with context that helps analysts determine if they are true positives
   • BTo replace the need for a ticketing system
   • CTo automatically resolve all alerts without analyst review
   • DTo generate new alerts from raw network traffic
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A risk manager is prioritizing mitigation efforts for a set of identified risks. The threat intelligence indicates that a specific vulnerability is being actively exploited in the wild, but the organization has compensating controls that reduce the likelihood of exploitation. Another vulnerability has a higher CVSS score but is not currently being exploited. How should the risk manager prioritize?

   • APrioritize the actively exploited vulnerability because current threat activity increases the likelihood, even with compensating controls.
   • BPrioritize the higher CVSS vulnerability because the severity score is higher.
   • CDefer both mitigations until more threat intelligence is available.
   • DTreat both vulnerabilities equally because they are both significant.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A risk analyst is enhancing the organization's risk scoring model. The model currently uses asset value, vulnerability severity, and control effectiveness. The analyst wants to incorporate threat intelligence to better reflect the current threat landscape. The organization has a limited budget and cannot implement a full TIP. What is the most effective approach?

   • AReplace the vulnerability severity with the threat intelligence severity from the feed.
   • BAdd a threat intelligence factor to the risk score that reflects the relevance and activity of threats targeting the organization's industry and assets.
   • CUse the threat intelligence feed to automatically adjust all risk scores by a fixed multiplier.
   • DWait until the organization can afford a TIP before incorporating threat intelligence into risk scoring.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A SOC is integrating a new threat intelligence feed into its SIEM. The feed contains a high volume of indicators, but many are outdated or have low confidence. The SOC wants to avoid overwhelming analysts with false positives while still detecting genuine threats. Which integration strategy is most effective?

   • AIngest all indicators and create alerts for every match, then let analysts manually filter.
   • BIngest only indicators that are older than six months because they are more established.
   • CIngest only the first 100 indicators from the feed to limit volume.
   • DIngest all indicators but apply a confidence threshold and age-based decay so that only high-confidence, recent indicators trigger alerts.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A risk manager is updating the organization's risk register. Threat intelligence indicates that a specific adversary group is actively targeting the organization's industry and has recently exploited a vulnerability in a legacy application that the organization still uses. The application is scheduled for decommissioning in six months. The risk manager must decide how to treat this risk. Which decision best balances risk reduction and business constraints?

   • AIgnore the threat intelligence because the application is scheduled for decommissioning anyway.
   • BApply a virtual patch or additional monitoring to the legacy application and accept the residual risk for the remaining six months.
   • CImmediately decommission the legacy application to eliminate the risk entirely.
   • DIncrease the risk score for the application but take no further action until the decommissioning date.
   Reveal Solution Discussion Select an answer first