After disseminating a threat intelligence report, the SOC team receives feedback from the incident response team that the report lacked specific IOCs. According to the threat intelligence lifecycle, what should the team do with this feedback?

Ignore the feedback because the report was already disseminated

Immediately re-analyze the same data without changes

Disseminate the same report to a wider audience

Use the feedback to refine the direction and collection phases for the next cycle

A small startup has no dedicated threat intelligence team but wants to stay informed about relevant threats. They have a limited budget and need a source that provides both context and IOCs. Which source is most appropriate?

A commercial threat intelligence platform with full-service support

Free OSINT feeds and community forums

A single vendor's proprietary threat report

A SOC analyst needs to find information about a recently discovered vulnerability in a widely used software product. They want a source that provides technical details and mitigation steps. Which source is most appropriate?

A competitor's marketing material

A social media post from an unknown user

EC-CouncilSOC Essentials

Domain 7Objective 1

Threat Intelligence Sources, Types, and Lifecycle SCE Practice Questions (Page 4)

Part of the Threat Intelligence and Hunting domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

3concepts

Questions 16–20

16foundation · easy
A SOC analyst needs to understand the motivations and capabilities of a specific threat actor group to brief senior management on long-term risks. Which type of threat intelligence is most appropriate for this purpose?
Select an answer first
17application · medium
After disseminating a threat intelligence report, the SOC team receives feedback from the incident response team that the report lacked specific IOCs. According to the threat intelligence lifecycle, what should the team do with this feedback?
Select an answer first
18application · medium
A small startup has no dedicated threat intelligence team but wants to stay informed about relevant threats. They have a limited budget and need a source that provides both context and IOCs. Which source is most appropriate?
Select an answer first
19foundation · easy
After a SOC team has analyzed threat intelligence and produced a report, they distribute it to relevant stakeholders. According to the threat intelligence lifecycle, what is the next phase that should occur?
Select an answer first
20application · medium
A SOC analyst needs to find information about a recently discovered vulnerability in a widely used software product. They want a source that provides technical details and mitigation steps. Which source is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Threat Intelligence Sources, Types, and Lifecycle SCE Practice Questions (Page 4)

Questions 16–20

A SOC analyst needs to understand the motivations and capabilities of a specific threat actor group to brief senior management on long-term risks. Which type of threat intelligence is most appropriate for this purpose?

After disseminating a threat intelligence report, the SOC team receives feedback from the incident response team that the report lacked specific IOCs. According to the threat intelligence lifecycle, what should the team do with this feedback?

A small startup has no dedicated threat intelligence team but wants to stay informed about relevant threats. They have a limited budget and need a source that provides both context and IOCs. Which source is most appropriate?

After a SOC team has analyzed threat intelligence and produced a report, they distribute it to relevant stakeholders. According to the threat intelligence lifecycle, what is the next phase that should occur?

A SOC analyst needs to find information about a recently discovered vulnerability in a widely used software product. They want a source that provides technical details and mitigation steps. Which source is most appropriate?

Keep studying — Threat Intelligence and Hunting