Threat Intelligence Sources CCOA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is an example of government-led threat intelligence sharing?

   • AA commercial threat feed subscription
   • BA national CERT/CSIRT advisory
   • CA public OSINT blog
   • DA private company's internal threat report
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is evaluating a commercial feed that provides excellent context and reports, but its indicators are often already published by free OSINT sources. The feed is significantly more expensive than the free sources. What is the most important consideration in deciding whether to subscribe?

   • AThe feed's added value in analysis, context, and reliability compared to free sources.
   • BThe feed's total number of indicators, since more is always better.
   • CThe feed's brand reputation, since well-known vendors are always better.
   • DThe feed's update frequency, since more frequent updates are always better.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is choosing between two commercial threat intelligence feeds. Feed X provides real-time indicators but has a higher false positive rate. Feed Y provides indicators with a 1-hour delay but has a very low false positive rate. The company's SOC is understaffed and cannot handle many false positives. Which feed should they choose?

   • AFeed Y, because the lower false positive rate will reduce alert fatigue, despite the delay.
   • BUse both feeds and let the SOC handle the additional alerts.
   • CChoose Feed X but disable all alerts to avoid false positives.
   • DFeed X, because real-time data is essential for security.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security operations center (SOC) wants to build a threat intelligence program with limited staff. They need to prioritize sources that provide the most value with the least manual effort. Which approach is most effective?

   • ASubscribe to a commercial feed that integrates directly with their SIEM.
   • BJoin multiple ISACs and attend all meetings to gather intelligence.
   • CRely on internal logs only, since they require no external subscriptions.
   • DManually monitor multiple OSINT sources daily for maximum coverage.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team is designing a threat intelligence program. They want to include sources that provide both external context and internal visibility. Which combination of sources best achieves this?

   • AOSINT and social media only
   • BCommercial feeds and internal logs
   • CGovernment alerts and ISACs only
   • DInternal incident reports and network telemetry only
   Reveal Solution Discussion Select an answer first