Leveraging Threat Intelligence for Hunting SCE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A threat intelligence analyst is tasked with setting up a process to continuously improve the quality of intelligence used by the SOC. The analyst wants to ensure that feedback from threat hunts is incorporated into future intelligence products. Which stage of the threat intelligence lifecycle should be formally updated with this feedback?

   • AProcessing
   • BAnalysis
   • CDissemination
   • DCollection
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SOC analyst is correlating internal telemetry with a threat intelligence feed. The feed provides a list of malicious IPs, and the analyst finds that several internal hosts have communicated with these IPs. To reduce false positives, what should the analyst do before escalating?

   • ABlock the IPs in the firewall
   • BEscalate immediately to the incident response team
   • CIgnore the findings because the feed is commercial
   • DCheck if the IPs are still malicious and if the communications are recent
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   After a threat hunt, the SOC team discovers that a previously unknown variant of a known malware family is using a new file path and a different C2 protocol. The team wants to improve future hunts. What should they do?

   • ADelete the old threat intelligence reports because they are no longer accurate
   • BWait for the next threat intelligence subscription update to include the new variant
   • CUpdate the threat intelligence feed with the new file path and C2 protocol
   • DOnly document the findings in the incident report and move on
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A threat intelligence report describes a new ransomware family that uses scheduled tasks to maintain persistence and communicates with a specific C2 domain. The SOC analyst wants to hunt for this ransomware in the environment. Which combination of telemetry would be most effective to correlate?

   • AAuthentication logs and VPN logs
   • BDNS logs and Windows Event Logs for scheduled task creation
   • CFirewall logs and web proxy logs only
   • DEDR alerts and antivirus logs only
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A threat hunter discovers a suspicious domain in DNS logs that matches an IOC from a commercial feed. The hunter wants to enrich the finding to determine if it is a real threat. The hunter has access to WHOIS, passive DNS, and a sandbox service. The hunter has limited time and must choose the most efficient enrichment method. Which method provides the most useful context for validation?

   • AQuery WHOIS and passive DNS to understand the domain's registration and history
   • BSubmit the domain to a sandbox service to analyze its behavior
   • CSearch the domain in the organization's web proxy logs
   • DAdd the domain to the SIEM watchlist
   Reveal Solution Discussion Select an answer first