A company uses an open-source threat intelligence platform (like MISP) to share IOCs with other organizations. The SOC wants to integrate these IOCs into their EDR solution to block known malicious files. What is the most effective way to achieve this?

Manually add each IOC to the EDR's blocklist

Only use the IOCs when a new alert is triggered

Use the MISP API to automatically export IOCs and import them into the EDR

Ask other organizations to send IOCs via email

A SOC analyst is reviewing a threat intelligence report that lists a specific file hash, a domain name, and an IP address associated with a recent malware campaign. The analyst wants to use this information to search the organization's SIEM logs for any matches. Which type of data is the analyst using?

Indicators of Compromise (IOCs)

Tactics, Techniques, and Procedures (TTPs)

Which of the following is an example of correlating threat intelligence with internal telemetry?

Matching a known malicious domain from a threat feed against DNS logs

Backing up logs to an external server

In hypothesis-driven hunting, what is the first step?

Formulating a hypothesis based on threat intelligence

Blocking all suspicious IP addresses

A threat hunter discovers a suspicious file hash in the environment that matches an IOC from a threat intelligence feed. The hunter wants to enrich the finding to determine if it is a real threat. Which action provides the most useful enrichment?

Check if the file hash is in the organization's allowlist

Add the file hash to the SIEM watchlist

Search the file hash in the organization's web proxy logs

Submit the file hash to a sandbox service to analyze its behavior

EC-CouncilSOC Essentials

Domain 7Objective 5

Leveraging Threat Intelligence for Hunting SCE Practice Questions (Page 2)

Part of the Threat Intelligence and Hunting domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

9concepts

9 Concepts in This Objective

Threat Intelligence Sources
Threat Intelligence Lifecycle
Indicators of Compromise (IOCs)
Tactics, Techniques, and Procedures (TTPs)
Threat Intelligence Integration
Hypothesis-Driven Hunting
Correlating Intelligence with Telemetry
Validation and Enrichment
Threat Hunting Feedback Loop

Questions 6–10

6application · medium
A company uses an open-source threat intelligence platform (like MISP) to share IOCs with other organizations. The SOC wants to integrate these IOCs into their EDR solution to block known malicious files. What is the most effective way to achieve this?
Select an answer first
7application · easy
A SOC analyst is reviewing a threat intelligence report that lists a specific file hash, a domain name, and an IP address associated with a recent malware campaign. The analyst wants to use this information to search the organization's SIEM logs for any matches. Which type of data is the analyst using?
Select an answer first
8foundation · easy
Which of the following is an example of correlating threat intelligence with internal telemetry?
Select an answer first
9foundation · easy
In hypothesis-driven hunting, what is the first step?
Select an answer first
10application · medium
A threat hunter discovers a suspicious file hash in the environment that matches an IOC from a threat intelligence feed. The hunter wants to enrich the finding to determine if it is a real threat. Which action provides the most useful enrichment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.