1.3 Explain the Role of Threat Intelligence in Incident Response and Incident Management CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A SOC wants to integrate threat intelligence into its incident response workflow to automate the containment of malicious IPs. The SOC uses a firewall, a SIEM, and an orchestration tool. The team wants to ensure that only high-confidence IOCs are automatically blocked to avoid disrupting legitimate traffic. Which approach best meets this requirement?

   • AAutomatically block all IOCs from the threat intelligence feed without filtering.
   • BBlock all IOCs from the feed and rely on the firewall's logging to identify false positives.
   • CConfigure the orchestration tool to block only IOCs with a high confidence score, and log all actions for review.
   • DManually review each IOC before adding it to the block list.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A mid-sized company detects a new ransomware variant that is not yet widely known. The SOC has identified the IOCs and wants to help other organizations defend against the same threat. What is the most appropriate action for the SOC to take?

   • ASell the IOCs to a commercial vendor for profit.
   • BKeep the IOCs internal to avoid revealing the company's security posture.
   • CShare the IOCs with an industry-specific threat intelligence sharing community.
   • DPublish the IOCs on a public blog without any context.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC team wants to establish a threat intelligence program to improve incident detection. They plan to collect data from open-source feeds, commercial subscriptions, and internal telemetry. The team's first step is to define a process that ensures the collected data is transformed into actionable intelligence. Which sequence of steps best represents the threat intelligence lifecycle?

   • ACollection, analysis, processing, dissemination
   • BDissemination, collection, analysis, processing
   • CCollection, processing, analysis, dissemination
   • DAnalysis, collection, dissemination, processing
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A large organization experiences a security incident that affects multiple business units. The SOC is coordinating the response with IT, legal, and public relations teams. Threat intelligence indicates that the attack is part of a broader campaign targeting the industry. How should the SOC use threat intelligence to improve incident management across teams?

   • AKeep the threat intelligence confidential within the SOC to avoid panic.
   • BOnly share the intelligence with the IT team because they handle technical response.
   • CWait until the incident is fully contained before sharing any intelligence.
   • DShare the threat intelligence with all teams so they understand the threat and can align their response actions.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is an example of an open-source threat intelligence feed?

   • AAn internal feed generated from the organization's own firewall logs
   • BA vendor-specific threat feed that requires a paid subscription
   • CA feed provided by a threat intelligence vendor as part of a managed service
   • DA community-maintained list of known malicious IP addresses
   Reveal Solution Discussion Select an answer first