Threat Intelligence Feeds and Platforms SCE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC manager wants to consolidate threat intelligence from multiple paid and free feeds, enrich it with context, and share relevant indicators with their SIEM and firewall. Which tool is designed for this purpose?

   • AThreat intelligence platform (TIP)
   • BConfiguration management database (CMDB)
   • CPacket capture tool
   • DVulnerability scanner
   Reveal Solution Discussion Select an answer first
2. 32expert · medium

   A company is considering deploying a TIP. The SOC team wants to reduce alert fatigue and improve response times. The company has a limited budget and a small team. Which factor is most important when selecting a TIP?

   • AEase of integration with existing SIEM and firewall tools
   • BNumber of pre-built dashboards
   • CVendor marketing reputation
   • DAbility to generate compliance reports
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A small financial firm wants to enrich its SIEM alerts with indicators of compromise (IOCs) for known banking trojans. The team has a limited budget and cannot afford a commercial feed. Which approach best meets the requirement while keeping operational overhead low?

   • APurchase a commercial feed and integrate it via API
   • BBuild an internal feed by collecting IOCs from the firm's own past incidents
   • CManually copy IOCs from a public blog into the SIEM each week
   • DSubscribe to a free open-source feed and configure the SIEM to ingest its STIX/TAXII endpoint
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company wants to automatically block known malicious IP addresses at the firewall. The IP list comes from a threat intelligence feed that updates hourly. Which integration approach is most appropriate?

   • AHave an analyst manually update the firewall rules each hour
   • BUse the firewall's API to push updated IP lists from the TIP on a schedule
   • CCopy the IP list into a shared spreadsheet and import it weekly
   • DConfigure the firewall to download the feed directly from the internet
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A SOC team wants to automate the enrichment of alerts with threat intelligence from their TIP. They use a SOAR platform. What is the most effective way to achieve this?

   • ACreate a SOAR playbook that queries the TIP API for IOCs and enriches alerts automatically
   • BConfigure the SIEM to ignore alerts without known IOCs
   • CHave analysts manually look up IOCs in the TIP when an alert fires
   • DExport IOCs from the TIP to a spreadsheet and share it weekly
   Reveal Solution Discussion Select an answer first