2.3 Explain the Role of Threat Intelligence in Incident Response SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A security team is planning to implement a threat hunting program. They have access to threat intelligence that includes IOCs and TTPs of a specific threat actor. The team wants to proactively search for signs of this threat actor in their environment. Which approach is most effective for threat hunting?

   • ASearching for the IOCs in the environment and alerting on any matches.
   • BUsing the TTPs to develop hypotheses and then searching for behavioral patterns that match those TTPs, using IOCs as supporting evidence.
   • CWaiting for the SIEM to generate alerts based on the IOCs.
   • DReviewing strategic intelligence reports about the threat actor's motivations.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   During which incident response phase does threat intelligence primarily help in identifying the scope of the compromise and the systems affected?

   • AEradication
   • BRecovery
   • CDetection
   • DTriage
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How are indicators of compromise (IOCs) typically used in incident detection?

   • ATo match against system and network activity
   • BTo encrypt sensitive data
   • CTo automatically patch vulnerabilities
   • DTo create new user accounts
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security operations analyst is triaging an alert about a suspicious executable downloaded by a user. The analyst has a hash of the file and wants to quickly determine if this file is known malware and gather context about its behavior. Which action best leverages threat intelligence during triage?

   • ABlock the hash on all endpoints immediately without further analysis.
   • BReview strategic intelligence reports about the threat actor suspected of targeting the industry.
   • CSearch internal logs for other instances of the same hash across the environment.
   • DSubmit the hash to a threat intelligence platform that provides reputation and behavioral sandbox results.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the threat intelligence lifecycle, which stage involves transforming raw data into a format that can be analyzed, such as normalizing logs or decoding files?

   • AProcessing
   • BAnalysis
   • CDissemination
   • DCollection
   Reveal Solution Discussion Select an answer first