Develop and Implement Customized Threat Intelligence Strategies, Including Both Open Source and Commercial Intelligence Providers. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large enterprise has a mature threat intelligence program. The team collects data from multiple commercial and OSINT sources, processes it into a standardized format, and disseminates it to various teams (SOC, IR, threat hunting). Recently, the SOC has complained that the intelligence is often outdated by the time they receive it, and the threat hunting team says the data is too generic to be useful. The team lead suspects the issue is in the processing and analysis phase of the intelligence lifecycle. Which of the following changes would most directly address the SOC's and threat hunting team's complaints?

   • AImplement a more frequent collection cycle and automate the processing pipeline to reduce the time between collection and dissemination.
   • BFocus all analysis efforts on producing strategic intelligence reports for senior management, as this is the most valuable output.
   • CIncrease the number of intelligence sources to ensure broader coverage, even if it means more data to process.
   • DDisseminate all raw collected data directly to the SOC and threat hunting teams so they can perform their own analysis.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of a threat intelligence strategy in an organization?

   • ATo store all threat data in a single centralized repository
   • BTo guarantee that all threats are detected before they occur
   • CTo replace the need for security monitoring tools
   • DTo align intelligence activities with the organization's security goals and operational needs
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an example of customizing a threat intelligence source?

   • AUsing the same intelligence feed for all departments without modification
   • BDisabling all threat intelligence feeds to reduce noise
   • CFiltering an OSINT feed to include only indicators related to the organization's industry
   • DSubscribing to a generic threat feed that includes all types of malware
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A university's security team is setting up a threat intelligence program. They have access to a variety of OSINT sources, including public malware sandbox reports, domain registries, and social media monitoring. The team's primary use case is to detect phishing campaigns targeting students and staff. They want to create a customized feed that is relevant to their environment. What is the most effective way to customize their OSINT collection to meet this specific use case?

   • AFilter the OSINT sources to focus on indicators related to phishing, such as newly registered domains that mimic the university's domain and URLs from recent malware sandbox reports.
   • BUse only social media monitoring to detect phishing campaigns, as they are often announced there before they appear in other feeds.
   • CSubscribe to a commercial threat intelligence feed that provides a general overview of phishing trends and rely on that instead of OSINT.
   • DCollect all available OSINT data into a single large feed and use a machine learning model to identify phishing-related indicators.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A large retail chain is developing a threat intelligence strategy. The company has a high volume of point-of-sale (POS) malware incidents. The security team has a commercial feed that provides indicators of POS malware, but the feed is expensive and the team is considering whether to continue the subscription. The team also has access to a free OSINT feed that includes some POS malware indicators. The CISO wants to ensure the strategy is cost-effective while maintaining detection capability. What is the most important factor to consider in this decision?

   • AThe total cost of the commercial feed, including any hidden fees for API access or support.
   • BThe ease of integrating the commercial feed into the existing Splunk environment.
   • CThe reputation of the commercial feed provider in the industry.
   • DThe coverage and timeliness of the commercial feed compared to the free OSINT feed for POS malware indicators.
   Reveal Solution Discussion Select an answer first