A SOC analyst receives an alert that a workstation contacted a known malicious IP address from a threat intelligence feed. The analyst checks the workstation's logs and finds that the connection was made by a legitimate software update process. What should the analyst do next?

Ignore the alert because the process is legitimate

Immediately isolate the workstation from the network

Validate the finding by checking if the IP is still malicious and if the update process is legitimate

During a threat hunt, an analyst finds that a single internal IP address matched a known malicious IP from a commercial threat intelligence feed. The analyst wants to validate this finding before escalating. Which action would best reduce false positives?

Verify if the internal IP is a NAT gateway or proxy that many users share

Immediately block the internal IP in the firewall to prevent potential compromise

Search for the same IP in open-source intelligence feeds to see if it is also listed there

Check the internal IP's historical DNS records to see if it ever resolved to a known malicious domain

EC-CouncilSOC Essentials

Domain 7Objective 5

Leveraging Threat Intelligence for Hunting SCE Practice Questions (Page 10)

Part of the Threat Intelligence and Hunting domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

9concepts

9 Concepts in This Objective

Threat Intelligence Sources
Threat Intelligence Lifecycle
Indicators of Compromise (IOCs)
Tactics, Techniques, and Procedures (TTPs)
Threat Intelligence Integration
Hypothesis-Driven Hunting
Correlating Intelligence with Telemetry
Validation and Enrichment
Threat Hunting Feedback Loop

Questions 46–48

46application · medium
A SOC analyst receives an alert that a workstation contacted a known malicious IP address from a threat intelligence feed. The analyst checks the workstation's logs and finds that the connection was made by a legitimate software update process. What should the analyst do next?
Select an answer first
47application · medium
During a threat hunt, an analyst finds that a single internal IP address matched a known malicious IP from a commercial threat intelligence feed. The analyst wants to validate this finding before escalating. Which action would best reduce false positives?
Select an answer first
48foundation · easy
Which category of threat intelligence source would a security team use to obtain real-time alerts about emerging malware campaigns from a vendor's global sensor network?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Leveraging Threat Intelligence for Hunting SCE Practice Questions (Page 10)

Questions 46–48

A SOC analyst receives an alert that a workstation contacted a known malicious IP address from a threat intelligence feed. The analyst checks the workstation's logs and finds that the connection was made by a legitimate software update process. What should the analyst do next?

During a threat hunt, an analyst finds that a single internal IP address matched a known malicious IP from a commercial threat intelligence feed. The analyst wants to validate this finding before escalating. Which action would best reduce false positives?

Which category of threat intelligence source would a security team use to obtain real-time alerts about emerging malware campaigns from a vendor's global sensor network?

Keep studying — Threat Intelligence and Hunting