2.3 Explain the Role of Threat Intelligence in Incident Response SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium

   A security team has identified a new zero-day vulnerability being exploited in the wild. They want to share this information with other organizations to help them defend against it. However, they are concerned about legal and ethical implications. Which action best balances the need to share with legal and ethical considerations?

   • ASharing the information with a trusted ISAC or a sector-specific sharing group, following established protocols and anonymizing sensitive details.
   • BKeeping the information internal to avoid any legal risk.
   • CPublishing the vulnerability details on a public forum to maximize reach.
   • DSelling the information to a commercial vendor for profit.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is considering joining an Information Sharing and Analysis Center (ISAC) to share threat intelligence with other organizations in their industry. What is a key benefit of participating in an ISAC?

   • AGuaranteed protection from all cyber threats.
   • BAccess to a trusted community of peers and timely, relevant threat intelligence.
   • CLegal immunity from any liability related to sharing.
   • DFree access to all commercial threat intelligence feeds.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team wants to proactively identify potential threats before they become incidents. They have access to threat intelligence feeds containing IOCs such as IPs, domains, and hashes. Which proactive measure would best leverage this intelligence?

   • AConfiguring the SIEM to alert on any matches against the IOC feeds.
   • BStoring the feeds in a spreadsheet for future reference.
   • CSharing the feeds with external partners without internal use.
   • DReviewing the feeds manually on a weekly basis.
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   A security team wants to use threat intelligence to proactively harden their defenses. They have identified a threat actor that is actively targeting their industry. The team has limited budget and must choose between two actions: (1) deploying new detection rules based on the threat actor's TTPs, or (2) patching known vulnerabilities that the threat actor exploits. Which action should take priority?

   • APatching known vulnerabilities first, as this removes the attack vector and reduces the attack surface.
   • BNeither, as threat intelligence is not reliable enough for proactive defense.
   • CDeploying detection rules first, as this provides immediate visibility into the threat actor's activities.
   • DDoing both simultaneously, as they are equally important.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is establishing a threat intelligence program to support its incident response team. The team wants to ensure that the intelligence they produce directly addresses the types of incidents they are most likely to face. According to the threat intelligence lifecycle, which step should be the first priority?

   • ACollecting as much raw data as possible from all available sources.
   • BSelecting and purchasing a commercial threat intelligence feed.
   • CEstablishing a platform to share intelligence with external partners.
   • DDefining intelligence requirements based on the organization's threat landscape and response priorities.
   Reveal Solution Discussion Select an answer first