1.3 Explain the Role of Threat Intelligence in Incident Response and Incident Management CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 8)

Questions 36–36

1. 36application · medium

   A financial services firm's SOC receives a threat intelligence report from a government CERT describing a new banking trojan campaign. The report includes the campaign's TTPs, the malware's command-and-control (C2) domains, and a strategic assessment of the threat actor's motivations. The SOC manager needs to quickly decide which incidents to prioritize and which containment actions to take. Which type of threat intelligence should the SOC use to directly inform the immediate containment actions?

   • ATechnical intelligence, because it provides the specific indicators of compromise (IOCs) such as C2 domains and malware hashes needed to block and contain.
   • BOperational intelligence, because it details the specific campaigns and attack vectors, enabling the SOC to identify affected assets.
   • CTactical intelligence, because it describes the TTPs and helps the SOC understand how the trojan operates, guiding response steps.
   • DStrategic intelligence, because it explains the threat actor's long-term goals and helps justify resource allocation.
   Reveal Solution Discussion Select an answer first