2.3 Explain the Role of Threat Intelligence in Incident Response SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A security analyst receives a report containing file hashes, malicious IP addresses, and domain names associated with a recent malware campaign. Which type of threat intelligence does this report primarily represent?

   • ATactical intelligence
   • BOperational intelligence
   • CTechnical intelligence
   • DStrategic intelligence
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team has identified a new malware variant during an incident and wants to share the indicators with other organizations in their sector to help them defend against it. Which action best aligns with threat intelligence sharing best practices?

   • APublishing the indicators to a sector-specific Information Sharing and Analysis Center (ISAC).
   • BKeeping the indicators internal to avoid any legal or ethical issues.
   • CSending the indicators only to the organization's legal team for review.
   • DPosting the indicators on a public social media platform.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security manager needs to brief the board of directors about the overall threat landscape and the potential impact of cyber threats on the organization's strategic goals. Which type of threat intelligence is most appropriate for this audience?

   • AOperational intelligence, which focuses on specific campaigns and their indicators.
   • BTactical intelligence, which details the tactics, techniques, and procedures (TTPs) of threat actors.
   • CTechnical intelligence, which includes specific IOCs like hashes and IPs.
   • DStrategic intelligence, which provides high-level analysis of threats, trends, and potential business impact.
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   A threat intelligence team is producing a report for incident responders about a new malware campaign. The team has collected raw data from various sources, but the data is noisy and contains many false positives. The team needs to ensure the report is accurate and actionable. Which step in the threat intelligence lifecycle is most critical to address this issue?

   • AFeedback, which involves gathering input from consumers of the intelligence.
   • BDissemination, which involves distributing the report to stakeholders.
   • CProcessing, which involves normalizing, filtering, and validating the raw data to remove noise and false positives.
   • DCollection, which involves gathering more data from additional sources.
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   An incident response team is investigating a breach and has identified a suspicious domain. They want to determine if this domain is part of a larger infrastructure used by the threat actor. The team has access to passive DNS data, WHOIS records, and a commercial threat intelligence platform. Which combination of actions would most effectively enrich the domain indicator?

   • AReviewing a strategic intelligence report about the threat actor's motivations.
   • BQuerying passive DNS for related domains, checking WHOIS for registration patterns, and searching the threat intelligence platform for associated indicators.
   • CBlocking the domain on the firewall immediately to prevent further compromise.
   • DSearching the domain in the organization's internal web proxy logs only.
   Reveal Solution Discussion Select an answer first