2.2 Identifying a Baseline of User, Asset, and Entity Context PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security operations center (SOC) wants to automatically enrich firewall logs with the business unit and criticality of the affected asset. The asset inventory contains the asset's IP address, hostname, business unit, and criticality. Which approach would enable this enrichment?

   • AUse the IP address in the firewall log as an aliasing field to join with the asset inventory's IP address.
   • BUse the hostname in the firewall log to join with the asset inventory's business unit.
   • CUse the firewall log's source port to join with the asset inventory's criticality.
   • DUse the firewall log's timestamp to join with the asset inventory's last seen time.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A global enterprise with offices in multiple regions receives threat intelligence feeds from various sources. The security team notices that many IOCs are outdated or not applicable to their environment. They want to implement a process to filter out irrelevant intelligence while preserving potentially useful data. Which approach best balances relevance and completeness?

   • ASubscribe only to a single trusted vendor feed and ignore all other sources to reduce noise.
   • BUse a scoring system that evaluates IOCs based on asset match, industry relevance, and freshness, and only ingest those that meet a threshold.
   • CAutomatically ingest all IOCs into the SIEM and rely on correlation rules to minimize false positives.
   • DManually review every IOC before ingestion to ensure relevance, discarding any that do not match the enterprise's assets.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A security analyst receives a threat intelligence report about a malware campaign targeting a specific type of industrial control system (ICS) software. The enterprise does not use any ICS software. What is the most appropriate action regarding this intelligence?

   • AStore it for future reference but do not act on it
   • BApply it to all detection rules to be thorough
   • CFilter it out as irrelevant to the enterprise's environment
   • DShare it with all employees to raise awareness
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations team receives a daily threat feed containing indicators of compromise (IOCs) for malware families targeting point-of-sale (POS) systems. The team's enterprise is a healthcare provider with no retail operations. The team lead wants to reduce alert fatigue by filtering out irrelevant IOCs. Which action best aligns with the principle of threat intelligence relevance assessment?

   • ACompare the feed's IOCs against the organization's asset inventory and user context, and only ingest IOCs that match the enterprise's technology stack and industry.
   • BConfigure the SIEM to automatically suppress all IOCs from feeds that are not labeled as 'critical'.
   • CIngest the feed and create alert rules for all IOCs to ensure comprehensive coverage.
   • DStore the feed in a raw data lake and only use it for retroactive hunting after a confirmed incident.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is implementing a data enrichment pipeline to add asset owner information to firewall logs. Which entity data source would provide the asset owner information?

   • AFirewall logs
   • BAsset management system
   • CCloud Audit Logs
   • DNetwork flow logs
   Reveal Solution Discussion Select an answer first