Leveraging Threat Intelligence for Hunting SCE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What do Tactics, Techniques, and Procedures (TTPs) describe in the context of threat intelligence?

   • AThe behavior and methods used by adversaries to achieve their objectives
   • BThe IP addresses used in a phishing campaign
   • CThe specific file hashes associated with malware
   • DThe vulnerability scores of affected systems
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A threat hunter is planning a hunt based on a report that a new ransomware group uses legitimate remote management tools for lateral movement. The hunter has limited time and must decide between two hypotheses: one based on the specific tools mentioned in the report, and one based on general lateral movement patterns. The hunter wants to maximize the chance of detecting the threat while minimizing false positives. Which hypothesis should the hunter choose?

   • AHunt for general lateral movement patterns such as new admin logons or service creation
   • BWait for more intelligence before starting the hunt
   • CHunt for the specific remote management tools mentioned in the report
   • DHunt for both the specific tools and general lateral movement patterns
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the threat intelligence lifecycle, which stage involves transforming raw data into a format that can be analyzed, such as normalizing logs or extracting indicators?

   • ACollection
   • BAnalysis
   • CProcessing
   • DDissemination
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A threat hunter finds a suspicious file on an endpoint that matches a known malware hash from a threat intelligence feed. Before taking action, the hunter wants to validate the finding. Which step would be most appropriate?

   • ACheck the file's digital signature and publisher information
   • BIgnore the finding because the hash is from an external feed
   • CDelete the file from the endpoint
   • DQuarantine the file immediately to prevent further spread
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of integrating threat intelligence into security tools like EDR and firewalls?

   • ATo provide a backup of security logs
   • BTo enhance detection and blocking capabilities by using known indicators
   • CTo replace the need for security analysts
   • DTo automatically block all traffic from unknown IP addresses
   Reveal Solution Discussion Select an answer first