Develop and Implement Customized Threat Intelligence Strategies, Including Both Open Source and Commercial Intelligence Providers. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the purpose of customizing threat intelligence sources?

   • ATo make all intelligence sources identical for consistency
   • BTo ensure the intelligence is relevant to the organization's specific threat landscape and use cases
   • CTo eliminate the need for human analysis of intelligence
   • DTo reduce the number of intelligence sources to a single feed
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A regional bank with a small security team wants to build a threat intelligence program. The bank's primary concern is credential theft and banking trojans targeting its customers. The team has a limited budget and no dedicated threat intelligence analysts. The CISO wants to start with a commercially available feed that provides high-fidelity indicators with minimal false positives, and the team plans to automate ingestion into their SIEM. Which approach best aligns with the bank's stated goals and constraints?

   • ARely solely on information sharing from a local financial sector ISAC and manually correlate it with the bank's own logs on a monthly basis.
   • BBuild an in-house OSINT collection system using free feeds and open-source tools to avoid subscription costs, and manually review indicators weekly.
   • CSubscribe to a commercial threat intelligence feed that focuses on financial-sector malware and integrate it directly into the SIEM for automated alerting.
   • DPurchase a general-purpose commercial feed covering all threat types and hire two new analysts to manage and analyze the incoming data.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of operationalizing threat intelligence?

   • AStoring threat reports in a shared drive for analysts to read
   • BCreating a presentation about threat trends for management
   • CSubscribing to a new threat intelligence feed
   • DAdding indicators of compromise to a SIEM for alerting
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A manufacturing company's SOC wants to incorporate OSINT into its detection pipeline. The team has identified several free feeds, including blocklists of known malicious IPs and domains. They are concerned about the high volume of indicators and the potential for false positives disrupting operations. They want to use the OSINT data to enrich alerts rather than to block traffic automatically. What is the most effective way to integrate these OSINT feeds into their Splunk environment?

   • AStore the OSINT data in a separate index and only reference it when a specific incident is being investigated by an analyst.
   • BIngest the feeds into Splunk as lookup tables and use them in correlation searches to add context to alerts, such as flagging events that match known malicious indicators.
   • CConfigure the firewall to block all IP addresses from the OSINT feeds immediately to reduce the risk of infection.
   • DCreate a Splunk saved search that runs every hour and sends an email digest of all matched indicators to the SOC manager for manual review.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a key component of a customized threat intelligence strategy?

   • AImplementing a single intelligence feed for all security functions
   • BAutomating all intelligence analysis without human review
   • CDefining the organization's intelligence requirements and priorities
   • DSelecting the most expensive commercial intelligence provider
   Reveal Solution Discussion Select an answer first