Threat Intelligence Sources, Types, and Lifecycle SCE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC analyst is preparing a threat briefing for the IT helpdesk team. The briefing should explain the current phishing campaign targeting the company, including the specific email subject lines and sender addresses used, so the helpdesk can recognize and report these emails. Which type of threat intelligence is most appropriate for this briefing?

   • ATechnical intelligence, because it provides IOCs
   • BOperational intelligence, because it describes the specific campaign details and indicators
   • CTactical intelligence, because it describes TTPs
   • DStrategic intelligence, because it provides high-level context
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A SOC team has been collecting threat intelligence from multiple sources but is finding that the data is inconsistent and difficult to analyze. They need to improve the efficiency of their intelligence process. Which phase of the lifecycle should they focus on?

   • ADirection
   • BProcessing
   • CDissemination
   • DCollection
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC team is building a threat intelligence program and has access to a commercial feed, an OSINT feed, and internal telemetry. The team wants to prioritize which sources to integrate into their SIEM first. The team has limited engineering resources and needs to reduce alert noise quickly. Which source should the team integrate first?

   • AAll sources simultaneously, to maximize coverage
   • BCommercial feed, because it provides high-confidence IOCs that can be used for automated alerting with fewer false positives
   • COSINT feed, because it is free and provides a large volume of indicators
   • DInternal telemetry, because it is specific to the organization
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A multinational corporation operates in regions with different data privacy laws. They need threat intelligence that is relevant to each region while ensuring compliance. Which approach is most appropriate?

   • AUse only internal intelligence from each region
   • BCollect all data centrally and distribute globally
   • CRely on local ISACs and regional OSINT sources
   • DUse a single global commercial feed for consistency
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A government agency is required to share threat intelligence with other agencies and private sector partners. They need a trusted, vetted source for sharing. Which source is most appropriate?

   • AAn open-source intelligence forum
   • BInternal incident reports only
   • CAn Information Sharing and Analysis Center (ISAC)
   • DA commercial threat intelligence vendor
   Reveal Solution Discussion Select an answer first