Threat Intelligence Sources, Types, and Lifecycle SCE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A mid-sized company wants to build a threat intelligence program on a limited budget. The team has decided to use free OSINT feeds, but the SOC lead is concerned about the volume of false positives and the lack of context in these feeds. Which lifecycle phase should the team enhance to address this concern?

   • ADirection
   • BCollection
   • CDissemination
   • DProcessing and analysis
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC analyst is evaluating a new threat intelligence source. The source provides detailed reports on threat actor groups, including their motivations, targets, and TTPs, but does not provide any IOCs. The analyst wants to use this source to improve the team's detection capabilities. Which type of intelligence is this source providing, and how should the analyst use it?

   • ATactical intelligence, to inform detection strategy and prioritize hunting activities
   • BTechnical intelligence, to block known malicious indicators
   • CStrategic intelligence, to brief executives on risk
   • DOperational intelligence, to identify specific campaigns
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC analyst receives a report from a government CERT describing the tactics, techniques, and procedures (TTPs) of a nation-state actor targeting the energy sector. The analyst needs to use this information to update detection rules. Which type of threat intelligence does this report primarily represent?

   • AStrategic intelligence
   • BTechnical intelligence
   • CTactical intelligence
   • DOperational intelligence
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A regional bank's SOC manager needs to brief the board of directors on emerging ransomware trends affecting the financial sector. The briefing must include high-level risk implications and recommended investment priorities, without technical jargon. Which type of threat intelligence should the SOC manager primarily use for this briefing?

   • ATactical intelligence from MITRE ATT&CK technique mappings
   • BTechnical intelligence from malware sandbox reports
   • COperational intelligence from active incident response cases
   • DStrategic intelligence from industry ISACs and vendor reports
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC analyst is investigating a phishing campaign targeting their organization. They need to find indicators of compromise (IOCs) such as malicious URLs and email subject lines. Which internal source would be most useful?

   • AThe organization's own email gateway logs
   • BAn open-source malware repository
   • CA government CERT advisory
   • DA commercial threat intelligence portal
   Reveal Solution Discussion Select an answer first