Threat Intelligence Sources CCOA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization's security team wants to build a threat intelligence capability that reflects threats specific to their environment. They have access to firewall logs, endpoint detection and response (EDR) alerts, and past incident reports. Which approach best leverages these internal sources?

   • AStore all logs for compliance but do not analyze them, as internal sources are too noisy.
   • BCorrelate internal telemetry with external intelligence to identify patterns unique to the organization.
   • CUse only internal logs to create a baseline, since external intelligence is not relevant to internal threats.
   • DReplace internal logs with commercial feeds to get a more complete picture of threats.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary contribution of internal threat intelligence sources?

   • AThey replace the need for external intelligence
   • BThey provide global threat landscape overviews
   • CThey are the only sources that can be used for compliance
   • DThey offer context about threats specific to the organization's environment
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is monitoring social media for early signs of a new ransomware campaign targeting their industry. They find a post on a public forum claiming a new ransomware strain is being distributed via a specific phishing lure. The post includes a sample hash but no other details. Which action best aligns with using this OSINT source effectively?

   • ATreat the post as a lead, corroborate it with other sources, and validate the hash before taking action.
   • BReport the post to law enforcement and wait for their official analysis before any internal action.
   • CImmediately block the hash across all security controls and alert the incident response team.
   • DDisregard the post because public forums are not reliable enough for operational intelligence.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security analyst is categorizing threat intelligence sources for a new threat intelligence program. Which of the following correctly identifies a primary category of threat intelligence sources?

   • AOpen-source, commercial, internal, and government/industry sharing groups
   • BIndicators of compromise, tactics, techniques, and procedures
   • CSIEM, EDR, firewall, and proxy logs
   • DStrategic, tactical, operational, and technical intelligence
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security operations team is evaluating a commercial threat intelligence feed. The feed provides high-fidelity indicators of compromise (IOCs) with low false positive rates, but it only covers a limited set of threat actors and has a 24-hour delay in updates. The team needs to prioritize which threats to block immediately. What is the most appropriate use of this feed?

   • AUse it as the sole source for automated blocking decisions because of its high fidelity.
   • BUse it to enrich and validate alerts from other sources, but not as the only trigger for blocking.
   • CReplace it with a free OSINT feed to save costs and get more timely updates.
   • DIgnore the delay and use the feed for real-time blocking since commercial feeds are always reliable.
   Reveal Solution Discussion Select an answer first