1.3 Explain the Role of Threat Intelligence in Incident Response and Incident Management CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC is building a threat intelligence capability. They want to include a source that provides real-time indicators of active campaigns, such as C2 domains and malware hashes, to support immediate detection. Which source type best fits this requirement?

   • ACommercial threat intelligence feeds that provide curated, real-time IOCs.
   • BStrategic reports from industry analysts.
   • CInternal telemetry from the organization's own network.
   • DOpen-source intelligence (OSINT) feeds from public blogs and forums.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A SOC analyst is reviewing an alert about a suspicious file download. The analyst checks the file hash against a threat intelligence platform and finds that the hash is associated with a known malware family. However, the analyst also notes that the file was downloaded from a legitimate software vendor's website. What is the most appropriate use of threat intelligence in this situation?

   • AIgnore the alert because the hash match is likely a coincidence.
   • BTreat the alert as a false positive because the file is from a legitimate vendor.
   • CBlock all downloads from the vendor's website immediately.
   • DInvestigate further to determine if the file has been tampered with or if the vendor's site was compromised.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In the threat intelligence lifecycle, what is the primary goal of the dissemination stage?

   • ATo collect raw data from multiple sources
   • BTo deliver actionable intelligence to the appropriate consumers in a timely manner
   • CTo store intelligence indefinitely for future reference
   • DTo analyze data and identify patterns
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SOC uses a threat intelligence platform (TIP) that aggregates IOCs from multiple sources. The SOC wants to use this intelligence to detect potential incidents in real time. Which approach best leverages the TIP for detection?

   • AOnly use the TIP to share IOCs with external partners.
   • BUse the TIP to generate weekly reports for analysts to review.
   • CIntegrate the TIP with the SIEM and EDR tools to automatically match IOCs against telemetry.
   • DExport the IOCs to a CSV file and manually compare them with network logs.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During an incident response, the SOC identifies that a host is communicating with a known malicious C2 domain. Threat intelligence indicates that the malware is a new variant that is not yet fully understood. The incident response team needs to contain the threat while preserving evidence for further analysis. Which action best aligns with threat intelligence-informed containment?

   • ABlock the C2 domain at the firewall and isolate the host from the network.
   • BImmediately shut down the host to stop the communication.
   • CDisconnect the host from the network and immediately reimage it.
   • DIgnore the C2 communication and continue monitoring to gather more intelligence.
   Reveal Solution Discussion Select an answer first