Develop and Implement Customized Threat Intelligence Strategies, Including Both Open Source and Commercial Intelligence Providers. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A non-profit organization has a small security team and wants to start using OSINT to improve its security posture. The team has identified several free feeds but is concerned about the time required to manage them. They want to automate the collection and processing of these feeds as much as possible. What is the most effective way to automate the management of OSINT feeds in their Splunk environment?

   • AUse a Splunk add-on or a script to automatically download and ingest the feeds into a dedicated index, and schedule a job to update the lookups used in correlation searches.
   • BManually download the feeds each week and upload them to Splunk as static lookup tables.
   • CSubscribe to a commercial feed that offers a Splunk app, even though it costs money, to avoid the manual work.
   • DHave an analyst review each feed daily and manually add new indicators to the SIEM.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security operations center is reviewing its threat intelligence lifecycle. The team has a process for collecting data from various sources, but the analysis phase is often delayed because analysts are spending too much time on manual data processing. The team wants to improve the efficiency of the processing and analysis phase. Which of the following actions would be most effective?

   • AAutomate the normalization and enrichment of collected data using a tool like Splunk, so analysts can focus on interpreting the data and producing intelligence.
   • BReduce the number of intelligence sources to decrease the volume of data that needs to be processed.
   • CHire more analysts to handle the manual processing workload.
   • DIncrease the frequency of data collection to ensure more data is available for analysis.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary goal of operationalizing threat intelligence?

   • ATo integrate intelligence into security operations, detection, and response workflows
   • BTo automate all security decisions without human intervention
   • CTo create a static report for executive management
   • DTo store intelligence in a secure repository for future reference
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a key consideration when comparing the cost of commercial threat intelligence providers?

   • AThe cost of the provider's marketing campaigns
   • BThe number of threat indicators provided per month
   • CThe provider's stock price and market valuation
   • DThe total cost of ownership, including integration and maintenance efforts
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial services firm is evaluating commercial threat intelligence providers. The firm's key requirements are: (1) coverage of financial-sector threats, (2) integration with their Splunk SIEM, and (3) a cost that fits their budget. The team has shortlisted three providers. Provider X has excellent coverage but no native Splunk integration. Provider Y has a Splunk app but its coverage is more general. Provider Z is cheap but has limited coverage of financial threats. Which provider should the firm choose?

   • AProvider X, because excellent coverage of financial threats is the most important requirement, and the lack of integration can be overcome with custom development.
   • BProvider Y, because the native Splunk integration will reduce implementation effort and the general coverage can be supplemented with OSINT.
   • CProvider X, because the firm can build a custom integration and the coverage is exactly what they need.
   • DProvider Z, because the low cost allows the firm to also subscribe to another provider or invest in other security tools.
   Reveal Solution Discussion Select an answer first