How can threat intelligence support the containment phase of incident response?

By automatically patching all vulnerabilities

By providing indicators to block malicious traffic

In what way can threat intelligence be used to tune security controls?

By disabling security controls to reduce false positives

By updating firewall rules to block known malicious IPs

By increasing the logging level of all systems

During an incident, an analyst finds an IP address in the logs that is not on any blocklist. The analyst wants to determine if this IP is related to the threat actor. Which technique is most effective for enriching this indicator?

Immediately blocking the IP on all firewalls.

Searching the IP in the organization's marketing database.

Performing passive DNS lookups to see what domains have resolved to this IP.

Checking the IP against a list of known benign IPs.

An incident response team is investigating a breach and has identified a command-and-control (C2) domain. They want to find other infrastructure associated with the same threat actor. Which threat intelligence source would be most useful for this purpose?

A strategic intelligence report about the threat actor's motivations.

Internal DNS logs from the organization's own network.

An open-source list of known malicious IP addresses.

A commercial threat intelligence feed that tracks threat actor infrastructure and provides related indicators.

Palo Alto NetworksCertified Security Operations Professional

Domain 2Objective 3

2.3 Explain the Role of Threat Intelligence in Incident Response SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Part of the Threat Intelligence and Incident / Case Response domain, which accounts for 16% of the SECURITY-OPERATIONS-PROFESSIONAL exam.

35questions here

7free pages

8concepts

16%of the exam

Questions 11–15

11foundation · easy
How can threat intelligence support the containment phase of incident response?
Select an answer first
12foundation · easy
Which of the following is an example of an indicator of compromise (IOC) that can be used to detect a potential security incident?
Select an answer first
13foundation · easy
In what way can threat intelligence be used to tune security controls?
Select an answer first
14application · medium
During an incident, an analyst finds an IP address in the logs that is not on any blocklist. The analyst wants to determine if this IP is related to the threat actor. Which technique is most effective for enriching this indicator?
Select an answer first
15application · medium
An incident response team is investigating a breach and has identified a command-and-control (C2) domain. They want to find other infrastructure associated with the same threat actor. Which threat intelligence source would be most useful for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.