Leveraging Predictive and Proactive Threat Intelligence TIE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security operations center (SOC) analyst at a financial institution notices that phishing campaigns targeting the organization historically spike in the weeks before quarterly tax filings. The analyst wants to use this historical pattern to allocate defensive resources more effectively. Which approach best applies predictive threat intelligence in this scenario?

   • AIncrease email filtering and user awareness training in the weeks leading up to the expected phishing surge based on historical data.
   • BDeploy a honeypot that mimics the organization's login portal to capture attacker techniques during the expected spike.
   • CImplement a machine learning model that scores incoming emails for phishing indicators in real time.
   • DConduct a retrospective analysis of past phishing emails to identify indicators of compromise for future detection.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security manager wants to create a comprehensive threat intelligence program that uses both predictive and proactive intelligence. The program should include forecasting future threats, actively hunting for current threats, and sharing intelligence with partners. Which set of activities best represents this integrated program?

   • AOnly subscribe to a commercial threat intelligence feed and block indicators automatically.
   • BAnalyze historical attack data to forecast trends, conduct regular threat hunts, and participate in an ISAC.
   • CPurchase a SIEM and rely on its built-in correlation rules for detection.
   • DConduct annual penetration tests and vulnerability assessments.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security analyst at a financial firm notices that a known banking trojan's command-and-control (C2) domain has been registered but is not yet active. The analyst wants to search the internal network for any host that may have already communicated with this domain, even though no alerts have fired. Which approach best fits this objective?

   • AWait for the domain to become active and then rely on the existing intrusion detection system to generate alerts.
   • BBlock the domain at the firewall and assume that no internal host has communicated with it.
   • CUse a machine learning model to predict which internal hosts are most likely to be targeted by the trojan.
   • DRun a proactive hunt across DNS logs and proxy logs for any queries or connections to the newly registered domain.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security analyst is conducting a threat hunt based on a hypothesis that attackers are using living-off-the-land binaries (LOLBins) to evade detection. The analyst has access to process execution logs and a list of known LOLBins. Which action is most effective for this hunt?

   • ABlock all known LOLBins from executing on endpoints.
   • BRun a machine learning model to predict which users are likely to be targeted by attackers.
   • CSearch process logs for executions of known LOLBins and correlate with parent process chains and network activity.
   • DWait for antivirus alerts to identify LOLBin usage.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security team wants to build a comprehensive threat intelligence program that both forecasts future threats and actively hunts for current hidden threats. The team has access to historical attack data, threat intelligence feeds, and a security operations center. Which approach best integrates predictive and proactive intelligence?

   • AConduct a monthly review of security incidents to identify lessons learned.
   • BUse historical data to forecast likely attack vectors and then proactively hunt for those indicators in the environment.
   • CImplement a SIEM to collect logs and generate alerts for known signatures.
   • DFocus only on real-time threat intelligence feeds to block known malicious IP addresses.
   Reveal Solution Discussion Select an answer first