Role of Threat Intelligence in SOC Operations SCE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC analyst is tasked with collecting threat intelligence from various sources, including open-source feeds, industry ISACs, and internal incident data. After collecting the data, the analyst needs to convert it into a consistent format for analysis. Which stage of the threat intelligence lifecycle does this activity represent?

   • ACollection, which involves gathering raw data from various sources.
   • BProcessing, which involves organizing and normalizing the collected data into a usable format.
   • CDissemination, which involves sharing the final intelligence with stakeholders.
   • DAnalysis, which involves deriving insights from the processed data.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A SOC analyst is preparing a briefing for the CISO about the organization's exposure to a new ransomware group. The CISO needs to understand the potential business impact and the likelihood of being targeted. Which type of threat intelligence should the analyst primarily use for this briefing?

   • AStrategic threat intelligence, such as reports on the group's motivations, targets, and industry trends.
   • BOperational threat intelligence, such as details of specific campaigns and attack timelines.
   • CTactical threat intelligence, such as the specific TTPs and tools used by the group.
   • DTechnical threat intelligence, such as hashes and C2 domains associated with the ransomware.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC analyst is investigating an alert that was triggered by a network connection to a known malicious IP address. The analyst wants to understand the context of the threat, such as the threat actor group and the campaign it is associated with. Which type of threat intelligence should the analyst consult?

   • AStrategic intelligence, because it provides high-level risk assessments.
   • BTactical intelligence, because it describes the tools and techniques used.
   • COperational intelligence, because it provides details about specific campaigns and threat actor groups.
   • DTechnical intelligence, because it provides the IP address and domain information.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A threat hunting team has limited time and resources. They have two intelligence reports: one describes a new malware family's TTPs, and the other provides a list of IoCs for a known campaign. The team needs to decide which report to use for a hunting exercise. The organization has no evidence of the known campaign, but the malware family is actively targeting the industry. Which report should the team prioritize?

   • ABoth reports equally, because they provide complementary information.
   • BThe TTP report, because it allows the team to hunt for behaviors that may indicate the new malware family, even without specific IoCs.
   • CThe IoC list, because it provides specific indicators that can be directly searched in logs.
   • DNeither report, because hunting should be based on internal data, not external intelligence.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SOC team is using threat intelligence to prioritize alerts. The SIEM generates alerts based on a new feed, but the team is overwhelmed by the number of alerts. Which approach best uses threat intelligence to reduce the alert volume while maintaining security coverage?

   • APrioritize alerts based on the relevance of the threat intelligence to the organization's industry and assets.
   • BIncrease the severity of all alerts from the new feed to ensure they are investigated.
   • CDisable the new feed to reduce the number of alerts.
   • DCreate a separate queue for all alerts from the new feed and review them weekly.
   Reveal Solution Discussion Select an answer first