A SOC team wants to integrate a commercial threat intelligence feed into their SIEM to automatically enrich alerts with context about suspicious IPs and domains. The SIEM supports STIX/TAXII protocols. Which integration approach should the team use?

Use a custom script to convert the feed to CSV and import it daily

Manually copy and paste indicators from the feed into the SIEM's watchlist

Configure the SIEM to pull intelligence via TAXII from the feed provider

Ask the feed provider to send indicators via email

What is the primary goal of validating threat intelligence findings?

To make threat intelligence more complex

To reduce false positives and improve detection accuracy

To delete all threat intelligence data

To increase the number of alerts generated

A SOC team wants to automatically block known malicious IPs at the firewall based on threat intelligence. They have a commercial feed that provides real-time updates. Which integration method is most effective?

Use a CSV file exported from the feed and import it into the firewall

Use the firewall's API to push indicators from the threat intelligence platform to the firewall

Ask the feed provider to send email alerts for each new IP

Manually update the firewall's blocklist every week

A SOC team uses a commercial threat intelligence feed that provides IOCs in STIX/TAXII format. They want to integrate this feed into their SIEM to automatically create alerts. What is the most efficient way to achieve this?

Only use the feed when a major incident occurs

Use a TAXII client to automatically pull the feed and push IOCs to the SIEM via API

Manually copy the IOCs into the SIEM's watchlist every day

Ask the feed provider to email the IOCs to the SOC team

A SOC team completes a threat hunting engagement and discovers a new adversary technique that was not previously documented. The team wants to improve their threat intelligence for future hunts. However, the team is concerned about sharing the technique publicly because it could alert the adversary. Which action best balances the need to improve intelligence with the risk of disclosure?

Share the technique with a trusted information-sharing community and create an internal detection rule

Keep the technique confidential and only document it internally

Wait for a commercial feed to include the technique

Publish the technique publicly to help the wider community

EC-CouncilSOC Essentials

Domain 7Objective 5

Leveraging Threat Intelligence for Hunting SCE Practice Questions (Page 4)

Part of the Threat Intelligence and Hunting domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

9concepts

9 Concepts in This Objective

Threat Intelligence Sources
Threat Intelligence Lifecycle
Indicators of Compromise (IOCs)
Tactics, Techniques, and Procedures (TTPs)
Threat Intelligence Integration
Hypothesis-Driven Hunting
Correlating Intelligence with Telemetry
Validation and Enrichment
Threat Hunting Feedback Loop

Questions 16–20

16application · medium
A SOC team wants to integrate a commercial threat intelligence feed into their SIEM to automatically enrich alerts with context about suspicious IPs and domains. The SIEM supports STIX/TAXII protocols. Which integration approach should the team use?
Select an answer first
17foundation · easy
What is the primary goal of validating threat intelligence findings?
Select an answer first
18application · medium
A SOC team wants to automatically block known malicious IPs at the firewall based on threat intelligence. They have a commercial feed that provides real-time updates. Which integration method is most effective?
Select an answer first
19application · medium
A SOC team uses a commercial threat intelligence feed that provides IOCs in STIX/TAXII format. They want to integrate this feed into their SIEM to automatically create alerts. What is the most efficient way to achieve this?
Select an answer first
20expert · hard
A SOC team completes a threat hunting engagement and discovers a new adversary technique that was not previously documented. The team wants to improve their threat intelligence for future hunts. However, the team is concerned about sharing the technique publicly because it could alert the adversary. Which action best balances the need to improve intelligence with the risk of disclosure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.