Leveraging Threat Intelligence for Hunting SCE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   After a successful threat hunting engagement, the SOC team identifies a new TTP that was not previously documented in their threat intelligence. The team wants to ensure that future hunts can benefit from this discovery. Which action best supports the threat hunting feedback loop?

   • AKeep the TTP confidential and only share it with the hunting team
   • BDocument the new TTP and update the threat intelligence repository and hunting playbooks
   • CDelete the TTP from the report to avoid confusion
   • DWait for the next threat intelligence feed update to include the TTP
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A financial services company has a mature SOC that already subscribes to a commercial threat intelligence feed. The SOC manager wants to add a source that provides raw, real-time indicators from a broad community of security researchers and incident responders, with minimal cost. The team plans to integrate this source into their SIEM for correlation with internal telemetry. Which type of source should they add?

   • AA government-provided feed that requires a formal information-sharing agreement
   • BA closed-source commercial feed from a vendor that offers a service-level agreement
   • CAn open-source intelligence (OSINT) feed such as AlienVault OTX or MISP
   • DAn internal feed generated from the company's own historical incident data
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the purpose of the threat hunting feedback loop?

   • ATo generate compliance reports
   • BTo eliminate the need for human analysts
   • CTo automate all threat hunting activities
   • DTo continuously improve threat intelligence based on hunting outcomes
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC analyst is investigating an alert that triggered on a known malicious IP address. The analyst checks the SIEM and finds that the IP address is associated with a legitimate cloud service used by the organization. What should the analyst do to reduce false positives in the future?

   • ABlock the IP address in the firewall
   • BIgnore the alert and move on
   • CRemove the IP from the threat intelligence feed
   • DEnrich the IOC with context and adjust the correlation rule to exclude legitimate cloud services
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A threat hunting team is analyzing a recent intrusion where the attacker used a previously unknown malware variant. The team has identified the malware's file hash, but they have also observed the attacker's behavior, such as using PowerShell to download additional payloads and establishing persistence via scheduled tasks. The team wants to develop a more durable detection that will remain effective even if the malware file hash changes. Which approach should they focus on?

   • AHunt for the malware's IP address in firewall logs
   • BHunt for the TTPs observed, such as PowerShell download patterns and scheduled task creation
   • CHunt for the malware's command-and-control domain
   • DHunt for the specific file hash across all endpoints
   Reveal Solution Discussion Select an answer first