Threat Intelligence Feeds and Platforms SCE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC manager must choose between two threat intelligence feeds. Feed X has a high volume of IOCs with a 20% false-positive rate but includes early indicators of emerging campaigns. Feed Y has a low volume with a 2% false-positive rate but often misses new campaigns until they are widely reported. The SOC has limited analyst time and needs to detect zero-day-like threats early. Which feed should they choose?

   • AUse Feed Y for blocking and Feed X for hunting
   • BReject both feeds and rely on internal telemetry
   • CFeed Y, because low false positives are more important for limited analyst time
   • DFeed X, because early detection of emerging campaigns is the priority, and false positives can be tuned with automation
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A financial institution wants to detect threats specific to their industry, such as banking trojans and phishing kits targeting their customers. They already use a general OSINT feed. Which additional feed type would best address their need?

   • AA commercial feed specializing in financial-sector threats
   • BA feed of generic malware signatures from antivirus vendors
   • CAnother general OSINT feed from a different provider
   • DAn internal feed of their own historical incidents only
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company wants to supplement its commercial threat intelligence with insights from its own network traffic and past incidents. Which type of feed should they develop?

   • AA government-provided feed
   • BAn OSINT feed
   • CInternal threat intelligence feed
   • DAnother commercial feed
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC wants to automatically enrich every SIEM alert with threat intelligence context, such as whether an IP is known malicious. The integration should not require manual steps. Which approach is most effective?

   • AExport the TIP data to a CSV and import it into the SIEM weekly
   • BConfigure the SIEM to query the TIP's API for enrichment on each alert
   • CUse the TIP to send alerts directly to analysts via email
   • DHave analysts manually look up IPs in the TIP when investigating alerts
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   During incident response, how can threat intelligence from a platform support the response team?

   • ABy replacing the need for forensic analysis of the affected systems.
   • BBy guaranteeing that the incident will not recur after the response is complete.
   • CBy providing additional context about the attacker, such as their tactics, techniques, and procedures (TTPs).
   • DBy automatically deleting all logs related to the incident to preserve evidence.
   Reveal Solution Discussion Select an answer first