A SOC team is investigating a phishing campaign that targeted their organization. They have identified the attacker's infrastructure by correlating their own email logs with a public blocklist of known malicious domains. Which combination of threat intelligence sources is the team using?

Open-source intelligence and commercial sources

Commercial sources and internal sources

Internal sources and open-source intelligence

Internal sources and government sources

A security engineer is evaluating threat intelligence sources for a new SOC. The engineer needs a source that provides real-time, high-confidence indicators with low false positives, and is willing to pay for a subscription. Which source category best fits this requirement?

Internal telemetry from the company's own sensors

Open-source intelligence (OSINT) feeds

Commercial threat intelligence feeds

EC-CouncilSOC Essentials

Domain 7Objective 1

Threat Intelligence Sources, Types, and Lifecycle SCE Practice Questions (Page 1)

Part of the Threat Intelligence and Hunting domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

3concepts

Questions 1–5

1foundation · easy
A security engineer is looking for specific indicators of compromise (IOCs) such as file hashes and malicious IP addresses to update firewall rules. Which type of threat intelligence is most directly applicable?
Select an answer first
2application · medium
A SOC team is investigating a phishing campaign that targeted their organization. They have identified the attacker's infrastructure by correlating their own email logs with a public blocklist of known malicious domains. Which combination of threat intelligence sources is the team using?
Select an answer first
3application · medium
A security engineer is evaluating threat intelligence sources for a new SOC. The engineer needs a source that provides real-time, high-confidence indicators with low false positives, and is willing to pay for a subscription. Which source category best fits this requirement?
Select an answer first
4expert · hard
A SOC team is analyzing a new malware strain. The analyst has collected samples, extracted IOCs, and identified the malware's behavior. The analyst now needs to determine if this malware is related to a known threat actor group and if the company is at risk. Which lifecycle phase is the analyst entering?
Select an answer first
5application · medium
A SOC team is investigating a series of attacks that appear to be part of a larger campaign. They need to understand the attacker's infrastructure and methods to identify other potential victims. Which type of threat intelligence would be most useful?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Threat Intelligence Sources, Types, and Lifecycle SCE Practice Questions (Page 1)

Questions 1–5

A security engineer is looking for specific indicators of compromise (IOCs) such as file hashes and malicious IP addresses to update firewall rules. Which type of threat intelligence is most directly applicable?

A SOC team is investigating a phishing campaign that targeted their organization. They have identified the attacker's infrastructure by correlating their own email logs with a public blocklist of known malicious domains. Which combination of threat intelligence sources is the team using?

A security engineer is evaluating threat intelligence sources for a new SOC. The engineer needs a source that provides real-time, high-confidence indicators with low false positives, and is willing to pay for a subscription. Which source category best fits this requirement?

A SOC team is investigating a series of attacks that appear to be part of a larger campaign. They need to understand the attacker's infrastructure and methods to identify other potential victims. Which type of threat intelligence would be most useful?

Keep studying — Threat Intelligence and Hunting