Threat Intelligence Feeds and Platforms SCE Practice Questions (Page 8)

Questions 36–40

1. 36expert · medium

   A threat hunter is using a TIP to identify potential indicators of compromise (IOCs) for a new malware campaign. The TIP has aggregated data from multiple feeds and shows a cluster of related domains and IPs. The hunter wants to determine which indicators are most likely to be malicious. Which TIP feature is most useful?

   • AAlert deduplication
   • BAutomated report generation
   • CConfidence scoring and risk rating of indicators
   • DFeed subscription management
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A threat hunter is reviewing a feed that includes a domain flagged as malicious. The hunter checks the TIP and finds that the domain is associated with a known APT group and has been observed in recent campaigns. Which action best applies this intelligence?

   • AWait for the feed to provide more context before acting
   • BAdd the domain to a blocklist without further analysis
   • CIgnore the domain because it is only one indicator
   • DCreate a detection rule that alerts on any traffic to the domain and its known related IPs
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A threat intelligence analyst is evaluating a new feed. The feed provides a large volume of IOCs, but the analyst notices that many IOCs are duplicates of existing feeds and some have low confidence scores. The analyst wants to determine if the feed adds value. Which approach is most appropriate?

   • AReject the feed because it has duplicates
   • BCompare the new feed's unique IOCs against existing feeds and assess their confidence
   • CUse the feed only for low-priority alerts
   • DAccept the feed because more IOCs are always beneficial
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A global organization is selecting a threat intelligence feed to support its 24/7 SOC. Feed X provides high-confidence IOCs but updates only every 12 hours. Feed Y provides lower-confidence IOCs but updates every 15 minutes. The SOC handles both long-term APT tracking and fast-moving ransomware campaigns. Which feed should be chosen?

   • AFeed Y, because frequent updates are essential for ransomware campaigns
   • BNeither feed, because no single feed can meet all needs
   • CFeed X, because high confidence is essential for APT tracking
   • DBoth feeds, using Feed X for APT tracking and Feed Y for ransomware detection
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A SOC team wants to use threat intelligence to proactively search for signs of a specific threat actor known to target their industry. They have a TIP with relevant IOCs and a SIEM with logs. What is the most effective way to conduct this hunt?

   • AReview only the most recent TIP IOCs and ignore older ones
   • BCreate hunting queries in the SIEM using TIP IOCs and search for related behaviors and anomalies
   • CWait for the SIEM to generate alerts based on the TIP IOCs
   • DBlock all TIP IOCs on the firewall and monitor for blocked traffic
   Reveal Solution Discussion Select an answer first