Role of Threat Intelligence in SOC Operations SCE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is an indicator of compromise (IOC) that a hunter might use to search for a specific malware infection?

   • AA known malicious file hash
   • BThe number of employees in the company
   • CThe organization's risk appetite
   • DThe company's stock price
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which statement best describes threat intelligence?

   • ARaw data about potential threats collected from various sources
   • BA list of known malware hashes and malicious IP addresses
   • CA real-time feed of all ongoing cyberattacks worldwide
   • DEvidence-based knowledge about threats that is analyzed and contextualized for action
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC team is using threat intelligence to support incident response. During an active incident, the team receives a new intelligence report that contains indicators that match the attacker's activity. However, the report also contains indicators that are not relevant to the incident. The team has limited time. How should the team use this intelligence?

   • AWait until the incident is over to analyze the report.
   • BUse only the indicators that match the current incident to contain the threat, and note the other indicators for later analysis.
   • CIgnore the report because it contains irrelevant indicators.
   • DBlock all indicators in the report, including those not relevant, to be safe.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC team is integrating a new threat intelligence feed into their SIEM. The feed provides indicators in STIX/TAXII format. The SIEM does not natively support this format. What is the most appropriate way to handle this integration?

   • AAsk the feed provider to send the indicators in a different format, such as CSV.
   • BManually copy the indicators from the feed into the SIEM's database.
   • CIgnore the feed and rely on the SIEM's built-in threat intelligence.
   • DUse a threat intelligence platform (TIP) that can ingest STIX/TAXII and forward normalized indicators to the SIEM.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A threat hunter is investigating a potential compromise. The hunter has access to a threat intelligence platform that provides strategic, tactical, operational, and technical intelligence. The hunter needs to identify whether the organization has been targeted by a specific APT group. Which type of intelligence should the hunter consult first?

   • ATechnical intelligence, because it provides IOCs such as IP addresses.
   • BTactical intelligence, because it describes the tools and techniques used.
   • CStrategic intelligence, because it provides high-level risk assessments.
   • DOperational intelligence, because it provides details about specific campaigns and the groups behind them.
   Reveal Solution Discussion Select an answer first