2.3 Explain the Role of Threat Intelligence in Incident Response SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which type of threat intelligence is most likely to be consumed by executive leadership to inform high-level organizational risk decisions?

   • ATactical intelligence
   • BStrategic intelligence
   • CTechnical intelligence
   • DOperational intelligence
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A threat intelligence analyst is collecting raw data from multiple sources, including open-source feeds, commercial feeds, and internal logs. After collection, what is the next step in the threat intelligence lifecycle?

   • ACollecting more data from additional sources.
   • BProcessing the data to normalize, filter, and format it for analysis.
   • CDefining new intelligence requirements.
   • DDisseminating the intelligence to stakeholders.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization's security team wants to detect potential command-and-control (C2) activity by monitoring network traffic. Which type of IOC would be most effective for this purpose?

   • ADomain names and IP addresses associated with known C2 infrastructure.
   • BRegistry keys modified by malware.
   • CFile hashes of known malware samples.
   • DEmail addresses used in phishing campaigns.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When sharing threat intelligence with external parties, which of the following is a key legal or ethical consideration?

   • AProtecting the confidentiality of any sensitive data included in the intelligence
   • BEnsuring that the intelligence is shared with as many parties as possible
   • CEnsuring that the intelligence is shared only with government agencies
   • DEnsuring that the intelligence is shared only after a formal incident is closed
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A security operations center (SOC) is receiving a high volume of alerts from a new detection rule based on a commercial threat intelligence feed. Many alerts are false positives, and the SOC team is becoming overwhelmed. The team needs to reduce the noise while maintaining detection capability. Which action is most appropriate?

   • ASwitching to a different threat intelligence feed without evaluating the current one.
   • BTuning the detection rule to require additional context, such as multiple indicators or specific behavior, before alerting.
   • CDisabling the detection rule entirely to stop the noise.
   • DIncreasing the severity of the alerts to ensure they are not ignored.
   Reveal Solution Discussion Select an answer first