Threat Intelligence Feeds and Platforms SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is comparing two open-source threat intelligence feeds. Feed A provides raw IOCs without context. Feed B provides IOCs with confidence scores, threat actor attribution, and recommended actions. The analyst needs to prioritize alerts for a limited team. Which feed is more suitable?

   • ANeither feed, because open-source feeds are not reliable
   • BFeed A, because raw IOCs are easier to ingest
   • CBoth feeds equally, because more data is always better
   • DFeed B, because it provides context that helps prioritize and respond
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A SOC team is evaluating a new threat intelligence feed. The feed provides IOCs in STIX/TAXII format and has a high reputation, but the team's SIEM does not natively support STIX/TAXII. What is the best way to integrate this feed?

   • AReplace the SIEM with one that supports STIX/TAXII natively
   • BUse a TIP to ingest the STIX/TAXII feed and then push normalized IOCs to the SIEM
   • CAsk the feed provider to send IOCs in CSV format via email
   • DManually copy IOCs from the feed into the SIEM
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company wants to supplement its commercial threat intelligence feed with information about threats specific to its own network and industry. Which type of feed should the company add?

   • AA generic open-source feed
   • BAnother commercial feed from a different vendor
   • CInternal feed derived from the company's own incident data and network telemetry
   • DA feed from a social media monitoring service
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization is considering a new threat intelligence feed. The feed provider publishes IOCs that are often outdated by the time they are released, and the source is not transparent about how the data is collected. What is the primary quality issue with this feed?

   • AToo many IOCs to process
   • BHigh cost of the feed
   • CIncompatibility with the SIEM
   • DLack of timeliness and reliability
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How can a threat hunter use threat intelligence from a feed to improve the effectiveness of a hunt?

   • ABy providing a list of all employees who have accessed external websites.
   • BBy replacing the need for log analysis and endpoint monitoring entirely.
   • CBy automatically quarantining all endpoints that match any indicator from the feed.
   • DBy using indicators from the feed to create hypotheses about potential threats that may be present in the environment.
   Reveal Solution Discussion Select an answer first