A threat intelligence report describes a phishing campaign that uses a specific attachment filename and a macro that downloads a payload from a URL. The SOC analyst wants to hunt for this campaign in the email logs and endpoint telemetry. Which correlation would be most effective?

Search for the attachment filename in the SIEM only

Search for emails with the attachment filename and then check if any endpoint downloaded the URL

Search for the URL in web proxy logs only

Search for the macro in all documents on endpoints

A SOC team completes a threat hunting engagement and discovers that a previously unknown adversary technique was used in their environment. The team wants to improve their threat intelligence for future hunts. Which action best supports the feedback loop?

Wait for a commercial feed to include the technique

Keep the technique confidential to avoid alerting the adversary

Delete the technique from the report to avoid clutter

Create a new detection rule based on the technique and share it with the threat intelligence community

A small organization with a limited budget wants to start a threat hunting program. They need a source of threat intelligence that is free, community-driven, and provides IOCs that can be integrated into their open-source SIEM. Which source should they choose?

MISP (Malware Information Sharing Platform)

A commercial feed from a major vendor

An internal feed generated from their own incidents

A government feed that requires a formal agreement

A small SOC team has limited budget and wants to start a threat hunting program. They need to obtain threat intelligence to guide their hunts. Which source would be most appropriate to start with?

Internal threat intelligence from past incidents only

Commercial threat intelligence feeds from a major vendor

Social media posts from security researchers

Open-source threat intelligence feeds and public reports

EC-CouncilSOC Essentials

Domain 7Objective 5

Leveraging Threat Intelligence for Hunting SCE Practice Questions (Page 3)

Part of the Threat Intelligence and Hunting domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

9concepts

9 Concepts in This Objective

Threat Intelligence Sources
Threat Intelligence Lifecycle
Indicators of Compromise (IOCs)
Tactics, Techniques, and Procedures (TTPs)
Threat Intelligence Integration
Hypothesis-Driven Hunting
Correlating Intelligence with Telemetry
Validation and Enrichment
Threat Hunting Feedback Loop

Questions 11–15

11application · medium
A threat intelligence report describes a phishing campaign that uses a specific attachment filename and a macro that downloads a payload from a URL. The SOC analyst wants to hunt for this campaign in the email logs and endpoint telemetry. Which correlation would be most effective?
Select an answer first
12application · medium
A SOC team completes a threat hunting engagement and discovers that a previously unknown adversary technique was used in their environment. The team wants to improve their threat intelligence for future hunts. Which action best supports the feedback loop?
Select an answer first
13application · easy
A small organization with a limited budget wants to start a threat hunting program. They need a source of threat intelligence that is free, community-driven, and provides IOCs that can be integrated into their open-source SIEM. Which source should they choose?
Select an answer first
14application · medium
A small SOC team has limited budget and wants to start a threat hunting program. They need to obtain threat intelligence to guide their hunts. Which source would be most appropriate to start with?
Select an answer first
15foundation · easy
Which stage of the threat intelligence lifecycle is primarily concerned with delivering actionable intelligence to the appropriate stakeholders in a timely manner?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.