A SOC team has completed the analysis phase of the threat intelligence lifecycle and produced a report on a new malware campaign. What is the next step in the lifecycle?

Disseminate the report to relevant stakeholders

Process the raw data into a standardized format

Collect more data from external sources

Define new intelligence requirements

A SOC manager is reviewing the threat intelligence program's effectiveness. The manager notices that the team is spending too much time manually validating indicators from a free OSINT feed, and that the commercial feed is underutilized. The manager wants to optimize the workflow. Which change best addresses the imbalance?

Integrate the OSINT feed directly into the SIEM for automated blocking

Stop using OSINT entirely and use only the commercial feed

Cancel the commercial feed subscription and rely solely on OSINT

Automate the ingestion and validation of the commercial feed into the SIEM, and use the OSINT feed only for manual research on specific threats

A SOC team is overwhelmed by the volume of threat intelligence from multiple sources. They need to prioritize which intelligence to act on first. The team has a mature detection program but limited analyst time. Which approach is most effective?

Act on all intelligence equally to avoid missing anything

Prioritize intelligence based on the organization's threat model and risk tolerance

Delegate all intelligence analysis to automated tools

Focus only on technical intelligence because it is most actionable

A SOC analyst is documenting the sources of threat intelligence available to their organization. Which of the following correctly categorizes a public malware sandbox report as a threat intelligence source?

Open-source intelligence (OSINT)

A SOC manager must decide how to allocate limited analyst time to consume threat intelligence. The team needs to improve detection of a specific APT group's techniques. Which type of intelligence should the team focus on to directly improve detection rules?

Technical intelligence with IOCs

Strategic reports on geopolitical motivations

Tactical intelligence detailing the APT's TTPs

Operational intelligence on specific campaigns

EC-CouncilSOC Essentials

Domain 7Objective 1

Threat Intelligence Sources, Types, and Lifecycle SCE Practice Questions (Page 6)

Part of the Threat Intelligence and Hunting domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

3concepts

Questions 26–30

26application · easy
A SOC team has completed the analysis phase of the threat intelligence lifecycle and produced a report on a new malware campaign. What is the next step in the lifecycle?
Select an answer first
27expert · hard
A SOC manager is reviewing the threat intelligence program's effectiveness. The manager notices that the team is spending too much time manually validating indicators from a free OSINT feed, and that the commercial feed is underutilized. The manager wants to optimize the workflow. Which change best addresses the imbalance?
Select an answer first
28expert · hard
A SOC team is overwhelmed by the volume of threat intelligence from multiple sources. They need to prioritize which intelligence to act on first. The team has a mature detection program but limited analyst time. Which approach is most effective?
Select an answer first
29foundation · easy
A SOC analyst is documenting the sources of threat intelligence available to their organization. Which of the following correctly categorizes a public malware sandbox report as a threat intelligence source?
Select an answer first
30expert · hard
A SOC manager must decide how to allocate limited analyst time to consume threat intelligence. The team needs to improve detection of a specific APT group's techniques. Which type of intelligence should the team focus on to directly improve detection rules?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.