1.3 Explain the Role of Threat Intelligence in Incident Response and Incident Management CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOC receives three alerts: (1) a known malware signature on a low-value asset, (2) a behavioral anomaly on a domain controller that matches a recently published APT report, and (3) a phishing email that was blocked by the email gateway. The SOC has limited staff and must prioritize. The threat intelligence report indicates that the APT is actively targeting the organization's industry. Which alert should be investigated first?

   • AThe known malware signature on the low-value asset, because it is a confirmed indicator.
   • BThe behavioral anomaly on the domain controller, because it matches an active APT campaign and affects a critical asset.
   • CAll alerts equally, because each could be a potential incident.
   • DThe blocked phishing email, because phishing is the most common initial attack vector.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC uses a commercial threat intelligence feed that provides indicators of compromise (IOCs) such as malicious IPs and domains. The SOC wants to improve its detection capabilities by integrating this feed into its security tools. Which integration approach would most effectively enable automated detection of threats?

   • AStore the IOCs in a spreadsheet for analysts to reference during investigations.
   • BShare the IOCs with external partners via a threat intelligence sharing platform.
   • CImport the IOCs into the SIEM and create correlation rules that alert on matches with network traffic and logs.
   • DManually review the feed daily and create firewall rules based on the IOCs.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key benefit of integrating threat intelligence into a SIEM platform?

   • AIt enriches alerts with context, helping analysts identify and prioritize true positives
   • BIt guarantees that no security incident will be missed
   • CIt replaces the need for human analysts
   • DIt automatically patches vulnerabilities in the network
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC wants to automate the blocking of malicious domains and IPs identified by threat intelligence feeds. The SOC uses a next-generation firewall (NGFW) and a SIEM. Which integration approach would provide the most efficient automated response?

   • AManually add the IOCs to the firewall's block list each day.
   • BConfigure the firewall to automatically pull and apply threat intelligence feeds.
   • CCreate a script that emails the IOCs to the firewall administrator for review.
   • DUse the SIEM to send alerts to analysts who then manually block the IOCs.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of integrating threat intelligence into security tools?

   • ADeleting old threat intelligence data from the SIEM
   • BManually copying threat reports into a shared folder for analysts to read
   • CPrinting threat intelligence reports and posting them on the office wall
   • DConfiguring a firewall to block traffic from IP addresses listed in a threat intelligence feed
   Reveal Solution Discussion Select an answer first