Role of Threat Intelligence in SOC Operations SCE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC is integrating a commercial threat intelligence feed into its SIEM. The feed provides a high volume of indicators, but the SIEM is generating too many alerts, most of which are false positives. The analyst wants to reduce noise while still detecting relevant threats. Which approach is the most effective?

   • AConfigure the SIEM to only alert on indicators that are associated with active campaigns in the feed.
   • BImport all indicators into a separate log store and review them manually.
   • CDisable the feed for 30 days and rely on internal detection rules.
   • DIncrease the severity threshold for all alerts generated by the feed.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC analyst receives a threat intelligence report from a government CERT describing a new campaign that targets the financial sector. The report includes detailed TTPs, but no specific IP addresses or file hashes. The analyst needs to configure the SIEM to detect this campaign. Which type of threat intelligence should the analyst primarily use to create detection logic?

   • ATactical intelligence, because it describes the tools and techniques used by the adversary.
   • BOperational intelligence, because it reveals specific campaigns and their timing.
   • CTechnical intelligence, because it provides indicators such as IPs and hashes.
   • DStrategic intelligence, because it explains the motivations and goals of the adversary.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In the threat intelligence lifecycle, what is the purpose of the 'processing' stage?

   • ATo collect data from external sources
   • BTo distribute intelligence to relevant stakeholders
   • CTo convert raw data into a format that can be analyzed
   • DTo identify patterns and trends in the data
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC team wants to automate the sharing of threat intelligence indicators with their firewall and endpoint protection platforms. Which approach is the most efficient?

   • AManually copy indicators from the intelligence portal into each tool.
   • BEmail the indicators to the security team to update the tools.
   • CCreate a spreadsheet of indicators and share it via a shared drive.
   • DUse an open-standard feed format such as STIX/TAXII to integrate with the security tools.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A threat hunting analyst is reviewing a report about a new attack technique that abuses Windows Management Instrumentation (WMI) for persistence. The report includes specific WMI event filter and consumer commands. Which hunting query would be most effective in identifying potential compromise?

   • ASearch for user accounts with administrative privileges.
   • BSearch for recently created WMI event subscriptions in the endpoint logs.
   • CSearch for all processes named 'wmiprvse.exe' running on endpoints.
   • DSearch for network connections to known malicious IP addresses.
   Reveal Solution Discussion Select an answer first