Threat Intelligence Sources, Types, and Lifecycle SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC analyst is documenting a newly identified phishing campaign targeting the company's finance team. The analyst has already extracted the sender domains, subject lines, and payload hashes, and now needs to share this information with the incident response team so they can update email filters. At which phase of the threat intelligence lifecycle is the analyst working?

   • ACollection
   • BAnalysis
   • CDissemination
   • DProcessing
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A SOC team is implementing a threat intelligence platform (TIP). The team has configured the TIP to automatically ingest OSINT feeds and commercial feeds. However, the team is overwhelmed by the volume of alerts generated by the OSINT feeds. The team lead wants to reduce the noise without losing the value of the OSINT data. Which lifecycle phase should the team adjust?

   • ADissemination, to send fewer alerts to the SOC team
   • BDirection, to change the intelligence requirements
   • CCollection, to stop ingesting OSINT feeds entirely
   • DProcessing, to add deduplication and enrichment steps that filter out low-quality indicators
   Reveal Solution Discussion Select an answer first
4. 8application · easy

   A SOC team is implementing a threat intelligence program. They have defined their intelligence requirements and are now collecting data from multiple sources. According to the threat intelligence lifecycle, what should they do immediately after collection?

   • AProvide feedback to the collection phase
   • BAnalyze the data for relevance
   • CDisseminate the raw data to all analysts
   • DProcess the data into a usable format
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC analyst is investigating an alert about a suspicious file. The analyst finds that the file's hash matches a known malware hash from a commercial feed, but the file also has a valid digital signature from a reputable software vendor. The analyst must decide whether to quarantine the file. Which type of threat intelligence should the analyst consult to make the best decision?

   • AStrategic intelligence to understand the threat landscape
   • BOperational intelligence about the attacker's infrastructure
   • CTechnical intelligence from a different commercial feed
   • DTactical intelligence to understand the adversary's TTPs and whether this file is part of a known campaign
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the threat intelligence lifecycle, which phase involves defining the intelligence requirements and identifying the specific questions the organization needs to answer?

   • AAnalysis
   • BDirection
   • CCollection
   • DProcessing
   Reveal Solution Discussion Select an answer first