Threat Intelligence Sources CCOA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A healthcare organization is considering joining a Health-ISAC to share threat intelligence. They are concerned about the sensitivity of sharing their own incident data. What should they consider?

   • AISACs typically have trusted sharing agreements and anonymization practices to protect sensitive data.
   • BSharing incident data with an ISAC is illegal under healthcare regulations.
   • CThe organization should never share any data to avoid legal liability.
   • DISACs require full public disclosure of all incidents, which is too risky.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of an Information Sharing and Analysis Center (ISAC)?

   • ATo sell threat intelligence to commercial vendors
   • BTo provide government surveillance of private networks
   • CTo facilitate threat intelligence sharing among organizations in a specific industry
   • DTo replace commercial threat intelligence feeds
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How is OSINT typically used in threat intelligence?

   • ATo provide real-time blocking of all malicious IP addresses
   • BTo supplement other intelligence sources with publicly available information on threats
   • CTo replace commercial threat intelligence feeds entirely
   • DTo provide legally privileged information about adversaries
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is considering subscribing to a commercial threat intelligence feed. The feed offers comprehensive coverage of multiple threat actor groups and provides context-rich reports, but it is expensive. The company's budget is limited. What is the most important factor to evaluate before purchasing?

   • AWhether the feed's coverage aligns with the company's industry and threat landscape.
   • BWhether the feed is from a well-known vendor, since brand reputation guarantees quality.
   • CWhether the feed includes more indicators than any other feed on the market.
   • DWhether the feed is updated in real-time, since that is the only acceptable standard.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An analyst is comparing two threat intelligence sources for a critical alert. Source A is a commercial feed with a reputation for high accuracy, but it updates every 6 hours. Source B is a real-time OSINT feed from a well-known researcher, but it occasionally publishes unverified indicators. The alert involves a fast-spreading worm. Which source should the analyst prioritize for immediate action?

   • AWait for Source A to update, since acting on unverified data is never acceptable.
   • BUse Source B for immediate blocking, but verify with Source A before making permanent changes.
   • CSource B, because real-time data is always the best choice for immediate action.
   • DSource A, because accuracy is more important than speed in all cases.
   Reveal Solution Discussion Select an answer first