Threat Intelligence Feeds and Platforms SCE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary role of a threat intelligence platform (TIP) in a security operations center?

   • ATo replace the SIEM by performing real-time log analysis and alerting on all security events.
   • BTo aggregate, correlate, and manage threat intelligence from multiple sources in one centralized system.
   • CTo automatically patch vulnerabilities in production systems based on the latest threat feeds.
   • DTo block all malicious IP addresses at the network perimeter without human intervention.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a core function of a threat intelligence platform?

   • AStoring and managing indicators of compromise (IOCs) from multiple feeds in a searchable format.
   • BPerforming deep packet inspection on network traffic to detect zero-day exploits.
   • CGenerating encryption keys for secure communication between SOC team members.
   • DConducting penetration tests to validate the security posture of the organization.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security analyst is considering using an open-source threat intelligence feed for a critical infrastructure environment. The analyst is concerned about the reliability of the feed. Which action best mitigates the risk of relying on a single open-source feed?

   • ACross-correlate the open-source feed with commercial and internal feeds
   • BUse the open-source feed exclusively to avoid vendor bias
   • COnly use the feed for low-severity alerts
   • DDisable all automation and rely on manual analysis
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A SOC team uses a TIP to manage threat intelligence, but analysts are overwhelmed by the volume of alerts generated from the TIP's correlation rules. The TIP is configured to alert on every IOC match, including low-confidence ones. What is the best way to reduce alert fatigue while maintaining visibility?

   • AAdjust the TIP's correlation rules to alert only on high-confidence IOCs or those with specific context
   • BIncrease the frequency of TIP feed updates
   • CRemove all low-confidence IOCs from the TIP
   • DDisable all TIP alerts and rely on manual searches
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a threat hunting exercise, an analyst wants to identify hosts that may have communicated with a known command-and-control (C2) domain listed in a threat feed. Which action best uses the threat intelligence to support this hunt?

   • ABlock the C2 domain on the firewall without further analysis
   • BAdd the C2 domain to a blocklist and ignore it
   • CSearch DNS logs for queries to the C2 domain and correlate with proxy logs
   • DDelete the C2 domain from the feed to avoid false positives
   Reveal Solution Discussion Select an answer first