Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A SOC team receives a commercial threat intelligence feed that provides IP addresses and domain names associated with known malware campaigns. The team wants to use this feed to improve detection. Which action best leverages this type of intelligence?

   • AUse the feed to update the organization's threat model and prioritize future security investments.
   • BBlock all IPs and domains from the feed at the perimeter firewall immediately.
   • CIngest the indicators into the SIEM and create alerts when any of them are observed in network traffic or logs.
   • DShare the feed with other organizations in an information-sharing community to improve collective defense.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which of the following is an example of a key performance indicator (KPI) for a SOC?

   • AThe number of security tools deployed in the SOC.
   • BThe average time to detect (MTTD) a security incident.
   • CThe total budget allocated to the SOC.
   • DThe number of security analysts employed in the SOC.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A SOC manager is designing a new secure enclave for a high-value application that processes payment card data. The manager wants to apply defensible architecture principles to minimize the attack surface and contain potential breaches. Which design decision best aligns with these principles?

   • APlace the application in a dedicated network segment with strict firewall rules that only allow required traffic from specific sources, and enforce least privilege on all accounts.
   • BPlace the application on the same network segment as other internal applications to simplify management and reduce costs.
   • CAllow all internal users to access the application without authentication to improve user experience.
   • DUse a single shared administrative account for all administrators to simplify access management.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A SOC manager is preparing a briefing for the board of directors about the threat landscape. The briefing should focus on the motivations and capabilities of adversaries targeting the financial sector, and the potential business impact. Which type of threat intelligence is most appropriate for this audience?

   • AOperational threat intelligence, which provides real-time alerts about ongoing campaigns and specific IOCs.
   • BTactical threat intelligence, which provides specific TTPs and detection rules for the SOC team.
   • CTechnical threat intelligence, which provides hashes, IP addresses, and domain names for blocking.
   • DStrategic threat intelligence, which provides high-level analysis of adversary trends, motivations, and risks relevant to business decisions.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   What is the key difference between traditional network segmentation and micro-segmentation?

   • AMicro-segmentation creates finer-grained zones, often at the workload or application level, while traditional segmentation uses broader network-level zones.
   • BMicro-segmentation uses physical separation, while traditional segmentation uses virtual firewalls.
   • CMicro-segmentation is a legacy approach, while traditional segmentation is modern.
   • DTraditional segmentation is only used in data centers, while micro-segmentation is only used in cloud environments.
   Reveal Solution Discussion Select an answer first