Threat Intelligence Feeds and Platforms SCE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is 'relevance' an important criterion when selecting a threat intelligence feed for an organization?

   • AA relevant feed contains indicators that are applicable to the organization's industry, geography, and technology stack.
   • BA relevant feed is one that uses the most advanced encryption for data transmission.
   • CA relevant feed is one that contains the highest number of indicators, regardless of their source.
   • DA relevant feed is always the cheapest option available on the market.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When evaluating a threat intelligence feed, what does 'timeliness' refer to?

   • AThe format in which the feed is delivered, such as JSON or STIX.
   • BThe level of confidence the vendor has in the accuracy of the indicators.
   • CThe number of indicators included in the feed.
   • DThe speed at which new indicators are published after they are discovered.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A SOC team is considering a free OSINT feed that is known for having a high number of IOCs but also a high rate of false positives. The team has limited time to investigate alerts. What is the best way to use this feed?

   • AIgnore the feed entirely
   • BUse the feed for threat hunting and manual analysis, not for automated blocking
   • CUse the feed only for historical analysis
   • DAutomatically block all IOCs from the feed
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SOC analyst is evaluating two threat intelligence feeds. Feed A provides IOCs within minutes of a new malware campaign but has a high false-positive rate. Feed B provides IOCs within days but has a very low false-positive rate. The SOC needs to block an active phishing campaign immediately. Which feed should the analyst prioritize?

   • AReject both feeds and rely on internal telemetry only
   • BFeed A, because timeliness is critical for an active campaign
   • CFeed B, because accuracy is more important than speed
   • DUse both feeds equally without prioritization
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A threat hunter is investigating a suspicious domain that appeared in a commercial threat intelligence feed. The hunter wants to understand the domain's reputation, related infrastructure, and any past associations with known malware families. Which TIP capability is most directly useful?

   • AGenerating a compliance report for the domain
   • BStoring the domain in a ticketing system
   • CAutomated alerting when the domain is mentioned on social media
   • DEnrichment and correlation of the domain with other indicators
   Reveal Solution Discussion Select an answer first