What makes an alert actionable?

It is generated for every event

It is specific and relevant to a potential threat

A security operations center (SOC) analyst is reviewing an alert about a user who clicked a link in an email, which led to the download of a file that then encrypted files on the user's machine and displayed a ransom note. How should the analyst classify this attack?

DDoS attack, because the user's system was overwhelmed

Ransomware attack, because the final impact was file encryption and a ransom demand

Phishing attack, because the initial vector was a malicious email link

Insider threat, because the user clicked the link

What is the primary purpose of aggregating threat data from multiple sources into a unified repository?

To replace all existing security tools with a single solution

To enable correlation and analysis across diverse data sets

To store data in its original format without transformation

To eliminate the need for human analysis

Which characteristic is important for an alert to trigger an appropriate response?

It is generated only during business hours

It includes enough context to understand the threat

A company's SIEM is generating a high number of alerts for port scans. Upon investigation, most of these are from a legitimate internal vulnerability scanner. The security team wants to reduce the noise while still detecting real external port scans. What is the most effective approach?

Disable the port scan detection rule entirely

Increase the alert severity for all port scans

Change the alert to only trigger on a single port scan event

Create an exception or suppression rule for the vulnerability scanner's IP address

Information Systems Security Management Professional

Domain 4Objective 2

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 7)

Part of the Security Operations domain, which accounts for 18% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

15concepts

18%of the exam

15 Concepts in This Objective

Threat intelligence sources
Threat data aggregation
Baseline analysis of network traffic
Baseline analysis of data
Baseline analysis of user behavior
Anomaly detection techniques
Anomaly analysis and investigation
Threat modeling methodologies
Threat modeling process
Attack classification
Attack categorization frameworks
Security event correlation
Correlation rules and tools
Actionable alert definition
Alert tuning and prioritization

Questions 31–35

31foundation · easy
What makes an alert actionable?
Select an answer first
32application · medium
A security operations center (SOC) analyst is reviewing an alert about a user who clicked a link in an email, which led to the download of a file that then encrypted files on the user's machine and displayed a ransom note. How should the analyst classify this attack?
Select an answer first
33foundation · easy
What is the primary purpose of aggregating threat data from multiple sources into a unified repository?
Select an answer first
34foundation · easy
Which characteristic is important for an alert to trigger an appropriate response?
Select an answer first
35application · medium
A company's SIEM is generating a high number of alerts for port scans. Upon investigation, most of these are from a legitimate internal vulnerability scanner. The security team wants to reduce the noise while still detecting real external port scans. What is the most effective approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.