4.2 Leveraging Threat Intelligence for Detection PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   Your organization has ingested a new threat intelligence feed that includes a list of malicious domains. You need to search your proxy logs for any traffic to these domains in the last 7 days. The feed is updated daily. What is the most effective way to perform this search?

   • AUse the latest IOC feed to construct a query against proxy logs for the domains.
   • BSearch firewall logs for the domains, as they capture all network traffic.
   • CUse a static list of domains from the initial feed import.
   • DSearch DNS logs for the domains, as they are the only source that records domain resolution.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why is measuring the frequency of repetitive alerts useful in a SOC?

   • AIt helps identify patterns of recurring events that may need attention
   • BIt replaces the need for threat intelligence feeds
   • CIt directly determines the risk score of an IOC
   • DIt automatically blocks the source of the alerts
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the main benefit of using IOC risk scores to determine alert severity and triage priority?

   • AIt eliminates the need for any manual review of alerts
   • BIt guarantees that no false positives will ever be generated
   • CIt ensures high-risk indicators are escalated and addressed promptly
   • DIt reduces the total number of alerts generated by the system
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   Your SOC has a detection rule that alerts on 'outbound connection to a known malicious IP'. The rule has been generating a high volume of alerts, and analysis shows that 95% of them are from a single internal server that is a legitimate application server. The server makes outbound connections to a third-party service, and the IP address of that service was incorrectly flagged as malicious in your IOC feed. The remaining 5% of alerts are from various other hosts. You need to reduce the noise from the application server while preserving detection for other hosts. What is the best action?

   • AWhitelist the application server's IP address for this specific rule.
   • BRemove the IP from the IOC feed.
   • CIncrease the alert threshold to require multiple outbound connections to the malicious IP.
   • DDisable the rule during the times when the application server is active.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   Your SOC has a detection rule that alerts on 'multiple failed logons from a single source'. The rule has been generating a high volume of alerts, and analysis shows that 90% of them are from a single internal IP address that is a known vulnerability scanner. The scanner is used by the security team for regular assessments. The remaining 10% of alerts are from various external IPs. You need to reduce the noise from the scanner while preserving detection of external threats. What is the best action?

   • AWhitelist the vulnerability scanner's IP address for this specific rule.
   • BIncrease the threshold for the number of failed logons required to trigger the alert.
   • CDisable the rule during the times when the scanner is active.
   • DChange the rule to only alert on failed logons from external IPs.
   Reveal Solution Discussion Select an answer first