Threat Intelligence Sources CCOA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization wants to use internal threat intelligence to improve its incident response. They have historical incident reports and network telemetry. What is the best way to use these sources?

   • AShare all internal data with external vendors without analysis.
   • BDelete old incident reports to reduce data storage costs.
   • CAnalyze past incidents to identify common attack patterns and update response playbooks.
   • DUse network telemetry only for real-time monitoring, not for trend analysis.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is a common limitation of commercial threat intelligence feeds?

   • AThey cannot be integrated with security tools
   • BThey are free but require extensive internal processing
   • CThey may not be tailored to the specific needs of an organization
   • DThey are always outdated
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An analyst is evaluating a new threat intelligence source. The source provides a high volume of indicators, but many are duplicates of existing data and some are outdated. The analyst has limited time to integrate new sources. What is the best course of action?

   • AReject the source entirely because it contains outdated indicators.
   • BIntegrate the source but disable all alerts to avoid noise.
   • CIntegrate the source fully because high volume is always beneficial.
   • DEvaluate the source for unique, timely indicators and integrate only those that add value.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is an example of an Open-Source Intelligence (OSINT) source?

   • AInternal firewall logs from the organization's network
   • BA vendor-specific threat intelligence feed that requires a subscription
   • CA classified government report on adversary tactics
   • DA public cybersecurity blog discussing recent malware campaigns
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Why is timeliness an important factor when evaluating threat intelligence sources?

   • ABecause all threat intelligence must be real-time to be useful
   • BBecause timeliness is more important than accuracy
   • CBecause sources that are slow are always unreliable
   • DBecause outdated intelligence may not reflect the current threat landscape
   Reveal Solution Discussion Select an answer first