Role of Threat Intelligence in SOC Operations SCE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A threat hunter is reviewing a report about a new ransomware family that uses PowerShell scripts to disable security tools. The report includes the specific command-line arguments used. Which type of threat intelligence is most useful for developing a hunting query?

   • AOperational intelligence, because it identifies the threat actor group behind the campaign.
   • BStrategic intelligence, because it explains the business impact of ransomware.
   • CTactical intelligence, because it describes the specific techniques and commands used by the adversary.
   • DTechnical intelligence, because it provides file hashes and IP addresses.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a threat hunting exercise, the SOC team uses a report about a specific threat actor's infrastructure. The report includes the actor's preferred VPN providers and email services. The team wants to search for any internal assets that may have communicated with these services. Which type of threat intelligence is the team primarily using?

   • ATechnical threat intelligence, which provides indicators like hashes and domains.
   • BTactical threat intelligence, which describes the actor's TTPs.
   • COperational threat intelligence, which provides details about specific campaigns and infrastructure.
   • DStrategic threat intelligence, which provides high-level analysis of the actor's goals.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC analyst is evaluating a new threat intelligence feed. The feed provides a list of IP addresses that have been reported as malicious by various sources. The analyst notices that some IPs are legitimate cloud providers. What is the primary reason to apply context and validation to this feed before integrating it into the SIEM?

   • ATo comply with data retention regulations.
   • BTo ensure the feed is compatible with the SIEM's data format.
   • CTo increase the volume of alerts generated by the SIEM.
   • DTo reduce false positives and avoid blocking legitimate services that share IP ranges with malicious actors.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How does threat intelligence typically integrate with a SIEM platform?

   • ABy directly blocking network traffic at the firewall
   • BBy storing all raw logs in a separate database
   • CBy providing a list of indicators that the SIEM uses to generate alerts when matched in logs
   • DBy replacing the SIEM's log collection capabilities
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A threat hunting team is planning a hunt based on a report about a new attack technique. The report includes both TTPs and IoCs. The team has a limited time window and needs to decide whether to hunt using TTPs or IoCs. The organization has a mature SIEM with good log coverage, but the attack technique is new and may not be well-covered by existing detections. Which approach is more likely to yield results?

   • AUse both TTPs and IoCs in a single query.
   • BWait for the SIEM to generate alerts based on the new technique.
   • CHunt using IoCs, because they are specific and can be searched directly in logs.
   • DHunt using TTPs, because the technique is new and IoCs may not be present in the environment yet.
   Reveal Solution Discussion Select an answer first