1.3 Explain the Role of Threat Intelligence in Incident Response and Incident Management CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is sharing threat intelligence with external communities important?

   • AIt guarantees that your organization will never be attacked again
   • BIt helps the broader security community detect and respond to threats more quickly
   • CIt is required by law in all jurisdictions
   • DIt allows competitors to gain access to your proprietary data
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC receives multiple alerts in a short period. One alert is a known malware signature that matches a high-value server, another is a low-severity phishing email that was blocked, and a third is an anomaly that could indicate lateral movement. The SOC has limited resources and must prioritize which alert to investigate first. Which approach best uses threat intelligence to triage these alerts?

   • AInvestigate all alerts simultaneously to avoid missing any potential threat.
   • BInvestigate the anomaly indicating lateral movement first because it may represent an active, sophisticated attack that has bypassed existing defenses.
   • CInvestigate the malware signature alert first because it is a known indicator and affects a high-value asset.
   • DInvestigate the phishing email first because it is the most common type of attack.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which factor, when provided by threat intelligence, is most useful for prioritizing an incident during triage?

   • AThe color of the attacker's malware icon
   • BThe number of bytes in the malware file
   • CThe name of the analyst who first detected the incident
   • DThe reputation of the command-and-control server associated with the incident
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of threat intelligence in cybersecurity operations?

   • ATo replace the need for human security analysts in incident response
   • BTo automatically block all network traffic from unknown sources
   • CTo provide actionable knowledge about threats that supports informed security decisions
   • DTo guarantee that no security incident will ever occur
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which scenario best illustrates the use of threat intelligence in incident detection?

   • AAn analyst manually reviews every log entry to look for anomalies
   • BA vulnerability scanner identifies missing patches on servers
   • CA company conducts a phishing simulation to train employees
   • DA firewall blocks traffic from an IP address that is listed in a threat intelligence feed as a known command-and-control server
   Reveal Solution Discussion Select an answer first