A manufacturing company receives threat intelligence in multiple formats: STIX/TAXII feeds from a government source, CSV reports from a commercial vendor, and unstructured PDFs from an industry group. The security team wants to correlate this data with internal security events in their SIEM. What is the most effective first step?

Store all raw feeds in a data lake and query them separately from SIEM alerts

Configure the SIEM to directly parse the raw PDF and CSV files without any preprocessing

Implement a threat intelligence platform (TIP) to normalize and aggregate the diverse feeds into a unified format

Manually review each source daily and create summary reports for the security analysts

Which tool category is commonly used to aggregate threat data from multiple sources into a unified repository for analysis?

Security Information and Event Management (SIEM) system

Which data characteristic would be most relevant to include in a data baseline for anomaly detection?

Data volume and access patterns

Information Systems Security Management Professional

Domain 4Objective 2

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 4)

Part of the Security Operations domain, which accounts for 18% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

15concepts

18%of the exam

15 Concepts in This Objective

Threat intelligence sources
Threat data aggregation
Baseline analysis of network traffic
Baseline analysis of data
Baseline analysis of user behavior
Anomaly detection techniques
Anomaly analysis and investigation
Threat modeling methodologies
Threat modeling process
Attack classification
Attack categorization frameworks
Security event correlation
Correlation rules and tools
Actionable alert definition
Alert tuning and prioritization

Questions 16–20

16application · medium
A manufacturing company receives threat intelligence in multiple formats: STIX/TAXII feeds from a government source, CSV reports from a commercial vendor, and unstructured PDFs from an industry group. The security team wants to correlate this data with internal security events in their SIEM. What is the most effective first step?
Select an answer first
17foundation · easy
Which attack type is characterized by overwhelming a target with a flood of traffic to make it unavailable?
Select an answer first
18foundation · easy
Which tool category is commonly used to aggregate threat data from multiple sources into a unified repository for analysis?
Select an answer first
19foundation · easy
Which data characteristic would be most relevant to include in a data baseline for anomaly detection?
Select an answer first
20foundation · easy
Which threat modeling methodology focuses on categorizing threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 4)

Questions 16–20

Which attack type is characterized by overwhelming a target with a flood of traffic to make it unavailable?

Which tool category is commonly used to aggregate threat data from multiple sources into a unified repository for analysis?

Which data characteristic would be most relevant to include in a data baseline for anomaly detection?

Which threat modeling methodology focuses on categorizing threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

Keep studying — Security Operations