4.2 Leveraging Threat Intelligence for Detection PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   Your SOC relies on threat intelligence feeds to detect emerging threats. Currently, analysts manually download and upload IOCs into your SIEM every morning. This process is error-prone and often results in missed detections when new IOCs are published during the day. You need to ensure that detection rules always use the most current indicators. What should you implement?

   • AA one-time import of the entire IOC feed into the SIEM.
   • BA process that only updates IOCs when a new alert is generated.
   • CA scheduled script that fetches IOCs from the feed API and updates the SIEM's threat intelligence list every hour.
   • DA manual process where analysts check the feed twice a day and update the SIEM.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following best describes an automated IOC ingestion process?

   • AA process that only runs when a new alert is generated
   • BA manual process where analysts copy IOCs from emails into the SIEM
   • CA one-time import of IOCs from a single feed
   • DA scheduled or event-driven process that pulls IOCs from feeds and updates the detection system
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   Your SOC uses a threat intelligence platform that aggregates IOCs from multiple feeds. The platform provides an API that can be used to retrieve IOCs. You need to ensure that your SIEM's detection rules use the latest IOCs from the platform. What is the most efficient way to achieve this?

   • AUse a static list of IOCs that is updated only when a new threat is reported.
   • BSet up a scheduled job that fetches IOCs from the platform's API and updates the SIEM's threat intelligence list.
   • CCreate a detection rule that queries the platform's API directly for each alert.
   • DManually export IOCs from the platform and import them into the SIEM on a weekly basis.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   Your SOC has been receiving a high volume of alerts for 'outbound connection to known bad IP' from a single internal server. Upon investigation, you find that the server is a legitimate web server that makes outbound calls to a third-party API, and the IP address of that API was incorrectly flagged as malicious in your IOC feed. The alerts are consuming analyst time. What is the most appropriate action?

   • AWhitelist the internal server's IP address for this specific alert rule.
   • BIncrease the alert threshold to require multiple outbound connections.
   • CRemove the IP from the IOC feed.
   • DDisable the alert rule entirely.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the key consideration when applying whitelisting to suppress false-positive alerts?

   • AEnsuring that genuine threats are not also suppressed
   • BRemoving the whitelist after one day
   • CMaking the whitelist as broad as possible to reduce all alerts
   • DApplying the whitelist to all alert types without review
   Reveal Solution Discussion Select an answer first