1.3 Explain the Role of Threat Intelligence in Incident Response and Incident Management CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which type of threat intelligence is primarily composed of indicators of compromise (IOCs) such as IP addresses, domain names, and file hashes?

   • AStrategic
   • BTechnical
   • COperational
   • DTactical
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a common benefit of sharing threat intelligence with internal stakeholders?

   • AIt guarantees compliance with all industry regulations
   • BIt allows the organization to avoid paying for commercial threat feeds
   • CIt eliminates the need for security awareness training
   • DIt ensures that all departments are aware of relevant threats and can take appropriate protective actions
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A multinational company is responding to a data breach that affects customers in multiple countries. The incident response team includes legal, PR, and IT teams from different regions. Threat intelligence indicates that the attack is part of a coordinated campaign. The SOC manager must ensure that all teams have the information they need to respond effectively while respecting legal constraints. What is the most appropriate approach?

   • AShare relevant threat intelligence with each team based on their role and legal requirements.
   • BOnly share intelligence with the legal team because they handle regulatory matters.
   • CKeep all threat intelligence confidential within the SOC to avoid legal issues.
   • DShare all threat intelligence with all teams immediately to ensure a coordinated response.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   During an incident, the SOC identifies that a server is communicating with a C2 domain that is listed in a commercial threat intelligence feed. However, the feed also shows that the domain was recently flagged as 'high confidence' but not 'confirmed'. The server is a critical production system that cannot be taken offline without business impact. The SOC must contain the threat. Which action best balances containment and business continuity?

   • AImmediately block the C2 domain at the firewall and isolate the server from the network.
   • BTake the server offline immediately to ensure the threat is contained.
   • CIgnore the alert because the domain is not 'confirmed' as malicious.
   • DBlock the C2 domain at the firewall but leave the server connected to the network.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which stage of the threat intelligence lifecycle involves transforming raw data into a format that can be analyzed?

   • ADissemination
   • BProcessing
   • CAnalysis
   • DCollection
   Reveal Solution Discussion Select an answer first