Threat Intelligence Feeds and Platforms SCE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is a primary benefit of automating the integration of threat intelligence feeds into security tools?

   • AIt allows the organization to ignore the quality of the threat intelligence feeds.
   • BIt guarantees that all false positives are completely eliminated from the detection system.
   • CIt eliminates the need for human analysts to review any security alerts.
   • DIt reduces the time between receiving new indicators and applying them to detection and blocking controls.
   Reveal Solution Discussion Select an answer first
2. 42expert · medium

   A company is considering using an internal threat intelligence feed derived from its own network telemetry. The SOC team wants to use this feed to detect threats that external feeds may miss. Which benefit is most directly associated with internal feeds?

   • AThey require no maintenance
   • BThey provide context specific to the organization's environment
   • CThey are free of false positives
   • DThey are always more accurate than commercial feeds
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An organization uses multiple threat intelligence feeds and wants to reduce duplicate alerts in the SIEM. The SOC manager wants a central platform to normalize and correlate indicators before they reach the SIEM. Which solution should be implemented?

   • ADeploy a threat intelligence platform (TIP) and configure feed ingestion and deduplication
   • BIncrease the SIEM's alert threshold to reduce duplicates
   • CCreate a manual process to remove duplicates in the SIEM
   • DUse a single feed instead of multiple feeds
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which scenario best illustrates the integration of a threat intelligence feed into a security tool?

   • AA SOC manager prints a weekly threat report and posts it on the office bulletin board.
   • BA vulnerability scanner generates a report of missing patches and emails it to the IT team.
   • CA firewall automatically downloads a blocklist of malicious IPs from a threat feed and updates its rules.
   • DAn analyst manually copies IP addresses from a blog post into a spreadsheet for future reference.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A SOC team wants to reduce alert fatigue by automatically correlating indicators from multiple threat feeds with their endpoint detection and response (EDR) telemetry. Which action directly enables this capability?

   • AAsk the threat feed provider to send IOCs via email
   • BDisable all threat feeds to reduce noise
   • CConfigure the EDR to ingest and correlate IOCs from the threat intelligence platform (TIP)
   • DManually copy IOCs from each feed into the EDR weekly
   Reveal Solution Discussion Select an answer first