A SOC is integrating a commercial threat intelligence feed into its SIEM and IDS. The feed includes a high volume of indicators, but the SOC team is small and already overwhelmed with alerts. The management wants to reduce false positives while ensuring that critical threats are not missed. Which strategy best balances these competing requirements?

Integrate only indicators with a high confidence score and high relevance to the organization's industry into the SIEM, and use the full feed for the IDS.

Use the feed only for the IDS and rely on manual analysis for SIEM alerts.

Integrate the full feed into both the SIEM and IDS, and increase the alert threshold to reduce the number of alerts.

Integrate the full feed into the SIEM but only for correlation, not for alerting.

How does threat intelligence primarily support the detection function in a SOC?

By automatically patching vulnerabilities in production systems

By replacing the need for log analysis

By providing indicators and behavioral patterns that improve detection rules

By providing legal advice on data breaches

A threat intelligence team is producing a report for the SOC. The report includes raw data from multiple sources, but the data has not been validated or correlated. The SOC analysts need to use this report to prioritize their hunting activities. What should the team do before disseminating the report?

Disseminate the raw data immediately so analysts can start hunting.

Collect more data to ensure completeness.

Store the data in a data lake for future use.

Process and analyze the data to produce validated intelligence.

A SOC analyst is investigating a phishing campaign that uses a specific lure document and a known C2 domain. The analyst has the file hash and the domain. Which combination of threat intelligence types is the analyst using to support the investigation?

Tactical intelligence (file hash) and strategic intelligence (domain).

Technical intelligence (file hash) and operational intelligence (campaign details).

Strategic intelligence (file hash) and tactical intelligence (domain).

Operational intelligence (file hash) and technical intelligence (domain).

A SOC is considering integrating a threat intelligence feed into its EDR solution. The feed provides both high-confidence and low-confidence indicators. The EDR has a limited number of blocking rules, and the SOC wants to avoid blocking legitimate applications. Which approach is most appropriate?

Create blocking rules only for high-confidence indicators and use low-confidence indicators for alerting only.

Do not integrate the feed because it contains low-confidence indicators.

Use only low-confidence indicators for blocking because they are more specific.

Create blocking rules for all indicators to maximize protection.

EC-CouncilSOC Essentials

Domain 7Objective 3

Role of Threat Intelligence in SOC Operations SCE Practice Questions (Page 2)

Part of the Threat Intelligence and Hunting domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 6–10

6expert · hard
A SOC is integrating a commercial threat intelligence feed into its SIEM and IDS. The feed includes a high volume of indicators, but the SOC team is small and already overwhelmed with alerts. The management wants to reduce false positives while ensuring that critical threats are not missed. Which strategy best balances these competing requirements?
Select an answer first
7foundation · easy
How does threat intelligence primarily support the detection function in a SOC?
Select an answer first
8expert · hard
A threat intelligence team is producing a report for the SOC. The report includes raw data from multiple sources, but the data has not been validated or correlated. The SOC analysts need to use this report to prioritize their hunting activities. What should the team do before disseminating the report?
Select an answer first
9application · medium
A SOC analyst is investigating a phishing campaign that uses a specific lure document and a known C2 domain. The analyst has the file hash and the domain. Which combination of threat intelligence types is the analyst using to support the investigation?
Select an answer first
10expert · hard
A SOC is considering integrating a threat intelligence feed into its EDR solution. The feed provides both high-confidence and low-confidence indicators. The EDR has a limited number of blocking rules, and the SOC wants to avoid blocking legitimate applications. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Role of Threat Intelligence in SOC Operations SCE Practice Questions (Page 2)

Questions 6–10

How does threat intelligence primarily support the detection function in a SOC?

A SOC analyst is investigating a phishing campaign that uses a specific lure document and a known C2 domain. The analyst has the file hash and the domain. Which combination of threat intelligence types is the analyst using to support the investigation?

A SOC is considering integrating a threat intelligence feed into its EDR solution. The feed provides both high-confidence and low-confidence indicators. The EDR has a limited number of blocking rules, and the SOC wants to avoid blocking legitimate applications. Which approach is most appropriate?

Keep studying — Threat Intelligence and Hunting