Threat Intelligence Feeds and Platforms SCE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement best describes the purpose of an internal threat intelligence feed?

   • AIt aggregates threat data from multiple external sources into a single standardized format.
   • BIt contains indicators and contextual data derived from the organization's own network, endpoints, and incident history.
   • CIt provides indicators from external vendors to supplement the organization's own threat data.
   • DIt is a free, publicly accessible source of indicators maintained by a community of security researchers.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A SOC wants to automate the sharing of threat intelligence with a partner organization. The partner uses a different TIP platform. Which approach is most effective for automated sharing?

   • AExport indicators to a PDF and email them to the partner
   • BManually copy indicators into the partner's TIP
   • CUse the TIP's built-in sharing feature that supports STIX/TAXII
   • DUse a shared spreadsheet that both teams update
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company wants to integrate a threat intelligence feed into its SIEM, but the feed provider only offers a proprietary API that the SIEM does not support. The company has a limited budget and cannot purchase a commercial TIP. What is the most practical solution?

   • AAsk the feed provider to change their API to support the SIEM
   • BManually update the SIEM with IOCs from the feed
   • CBuild a custom integration script that pulls from the API and pushes to the SIEM
   • DReplace the SIEM with one that supports the API
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security analyst is categorizing threat intelligence sources for a new SOC. Which description correctly matches a type of threat intelligence feed?

   • AA commercial feed is provided by a vendor or research organization and typically requires a paid subscription.
   • BAn open-source feed is maintained by a single vendor and requires a paid subscription to access.
   • CAn internal feed is generated from publicly available data such as government reports and public malware repositories.
   • DAn open-source feed is always more timely than a commercial feed because it is updated continuously by volunteers.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SOC team uses multiple threat intelligence feeds, but analysts complain that the data is inconsistent and difficult to compare. They want a single interface to view and correlate indicators from all feeds. What should they implement?

   • AA new firewall rule set
   • BA second SIEM
   • CA manual spreadsheet
   • DA threat intelligence platform (TIP)
   Reveal Solution Discussion Select an answer first