Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A SOC receives logs from multiple sources, but the SIEM is generating a high number of false positives because the same event is logged in different formats with different field names. The SOC manager wants to reduce false positives without losing detection capability. Which action is most effective?

   • AUse a separate SIEM for each log source to avoid mixing formats.
   • BIncrease the alert threshold for all rules to reduce the number of alerts.
   • CDisable the detection rules that generate the most false positives.
   • DCreate a normalization layer that maps all log sources to a common schema and then tune detection rules based on the normalized data.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of the 'Feedback' stage in the threat intelligence lifecycle?

   • ATo validate the accuracy of every indicator before it is shared.
   • BTo archive all raw data for compliance purposes.
   • CTo automatically block all indicators identified during analysis.
   • DTo refine intelligence requirements and improve future collection and analysis efforts.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which type of threat intelligence is most commonly consumed by security operations center (SOC) analysts for day-to-day detection and response?

   • AStrategic intelligence
   • BTechnical intelligence
   • CTactical intelligence
   • DOperational intelligence
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of data normalization in a SIEM environment?

   • ATo assign severity levels to each log based on the source system.
   • BTo delete duplicate logs to save storage space.
   • CTo convert logs from different sources into a common format for easier correlation and analysis.
   • DTo encrypt all log data at rest and in transit.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SOC manager is integrating threat intelligence into the incident response process. The team has access to a commercial IOC feed and an information-sharing community that provides detailed TTP reports. The manager wants to reduce the time to detect and respond to incidents while avoiding alert fatigue. The SOC currently has a high false-positive rate from intelligence-based alerts. Which strategy best addresses this challenge?

   • AAutomatically block all IOCs from the commercial feed at the firewall and ignore the TTP reports because they are not actionable.
   • BUse the TTP reports to build behavioral detection rules and use the IOC feed only for enrichment and prioritization, not for standalone alerts.
   • CDisable all intelligence-based alerts and rely only on internal detection rules to reduce false positives.
   • DIncrease the severity of all intelligence-based alerts so analysts prioritize them, regardless of false-positive rate.
   Reveal Solution Discussion Select an answer first