A multinational company has offices in multiple countries. A threat report indicates that a state-sponsored group is targeting the company's industry. The report includes IOCs for the group's malware. The company's security team must decide how to respond. The company has a mature security operations center (SOC) and a threat intelligence platform (TIP). Which approach best leverages the threat intelligence?

Share the IOCs with all employees so they can check their own devices

Manually review the IOCs and compare them to a spreadsheet of known indicators

Automatically ingest the IOCs into the TIP and correlate with internal telemetry

Wait for the government to issue a specific alert for the company

A security analyst is evaluating a new threat intelligence feed. The feed provides a high volume of indicators, but many are false positives. The analyst wants to ensure the feed is reliable. Which characteristic is most important to evaluate?

The timeliness of the indicators

A security analyst is looking for threat intelligence about a specific malware family that has been active in their region. They want to find detailed technical analysis, including IOCs and attack vectors. Which source is most likely to provide this level of detail?

A vendor's threat research blog

A security analyst is compiling a list of external sources to monitor for emerging threats. Which source is a government advisory that provides timely information about vulnerabilities and exploits?

A social media post from an unknown user

Vendor-specific product documentation

CISA Known Exploited Vulnerabilities (KEV) catalog

F5Certified Solution Expert, Security

Domain 1Objective 1

1.01 Analyze External Threat Research to Determine the Potential Impact to an Organization 401 Practice Questions (Page 3)

Part of the THREAT ANALYSIS domain, which makes up ~11% of our current practice bank. F5 does not publish an official question count, but from its 105-minute exam (~40–70 total, ~4–8 in this domain), expect 2–4 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

4concepts

Questions 11–15

11foundation · easy
A threat intelligence report describes that a specific threat actor uses spear-phishing emails with malicious attachments to gain initial access. What element of the report is being described?
Select an answer first
12expert · hard
A multinational company has offices in multiple countries. A threat report indicates that a state-sponsored group is targeting the company's industry. The report includes IOCs for the group's malware. The company's security team must decide how to respond. The company has a mature security operations center (SOC) and a threat intelligence platform (TIP). Which approach best leverages the threat intelligence?
Select an answer first
13expert · hard
A security analyst is evaluating a new threat intelligence feed. The feed provides a high volume of indicators, but many are false positives. The analyst wants to ensure the feed is reliable. Which characteristic is most important to evaluate?
Select an answer first
14application · medium
A security analyst is looking for threat intelligence about a specific malware family that has been active in their region. They want to find detailed technical analysis, including IOCs and attack vectors. Which source is most likely to provide this level of detail?
Select an answer first
15foundation · easy
A security analyst is compiling a list of external sources to monitor for emerging threats. Which source is a government advisory that provides timely information about vulnerabilities and exploits?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “401” is a trademark of its owner, used for identification only.

1.01 Analyze External Threat Research to Determine the Potential Impact to an Organization 401 Practice Questions (Page 3)

Questions 11–15

A threat intelligence report describes that a specific threat actor uses spear-phishing emails with malicious attachments to gain initial access. What element of the report is being described?

A security analyst is evaluating a new threat intelligence feed. The feed provides a high volume of indicators, but many are false positives. The analyst wants to ensure the feed is reliable. Which characteristic is most important to evaluate?

A security analyst is looking for threat intelligence about a specific malware family that has been active in their region. They want to find detailed technical analysis, including IOCs and attack vectors. Which source is most likely to provide this level of detail?

A security analyst is compiling a list of external sources to monitor for emerging threats. Which source is a government advisory that provides timely information about vulnerabilities and exploits?

Keep studying — THREAT ANALYSIS