Threat Intelligence Sources CCOA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an internal threat intelligence source?

   • AA commercial threat feed from a vendor
   • BNetwork telemetry from the organization's own infrastructure
   • CA public forum discussing a new exploit
   • DAn ISAC's threat report
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary role of threat intelligence sources in cybersecurity operations?

   • ATo provide automated incident response without human intervention
   • BTo guarantee that all cyberattacks are prevented
   • CTo replace the need for security monitoring tools
   • DTo provide context and actionable information about threats to support decision-making
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst discovers a new malware sample hash on a public malware analysis sandbox. The sandbox report shows the malware communicates with a specific domain. What is the most appropriate use of this OSINT?

   • AShare the hash with all employees to warn them about the malware.
   • BBlock the domain and hash immediately, as sandbox reports are authoritative.
   • CIgnore the report because public sandboxes are not reliable.
   • DUse the report to create detection signatures and monitor for related activity.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is deciding whether to join an ISAC or subscribe to a commercial feed. The ISAC offers sector-specific intelligence but requires active participation and sharing of internal data. The commercial feed offers broad coverage but is expensive. The company values both sector relevance and cost efficiency. What is the most balanced approach?

   • ASubscribe to the commercial feed only, since it requires less effort.
   • BJoin the ISAC only, since sector-specific intelligence is more valuable than broad coverage.
   • CUse free OSINT sources instead, since they are cost-free and require no sharing.
   • DJoin the ISAC and subscribe to the commercial feed, using each for different purposes.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When evaluating a threat intelligence source, what does 'reliability' refer to?

   • AHow relevant the information is to the organization's environment
   • BThe cost-effectiveness of the source
   • CThe trustworthiness and consistency of the source
   • DHow quickly the source provides new information
   Reveal Solution Discussion Select an answer first