Develop and Implement Customized Threat Intelligence Strategies, Including Both Open Source and Commercial Intelligence Providers. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A multinational corporation is developing its threat intelligence strategy. The company has a high risk of industrial espionage and targeted attacks. The CISO wants to invest in a commercial intelligence provider that offers strategic reports on threat actor groups and their TTPs. However, the SOC manager argues that the budget should be spent on more tactical feeds with IoCs for immediate detection. The company has a limited budget and can only afford one provider. Which approach best balances the strategic and tactical needs of the organization?

   • APrioritize the tactical IoC feed, as the SOC needs it for immediate detection, and rely on free OSINT reports for strategic context.
   • BSelect a provider that offers both strategic reports on threat actors and a tactical feed of IoCs, even if the coverage is not as deep as specialized providers.
   • CSplit the budget between two providers: one for strategic reports and one for tactical IoCs, even if it means getting less from each.
   • DPrioritize the strategic reports, as understanding the threat actors is more important than having a list of IoCs that will become stale quickly.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of an open source threat intelligence source?

   • AA public malware analysis sandbox that publishes indicators of compromise
   • BA private threat intelligence sharing community restricted to member organizations
   • CA vendor-specific threat intelligence portal that requires a paid subscription
   • DAn internal threat intelligence database maintained by the organization's SOC
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A small e-commerce company wants to use OSINT to protect its web applications. The team has identified several free feeds that contain indicators of compromise, such as malicious IPs and URLs. They are concerned about the reliability of these feeds and want to ensure they are using high-quality data. What is the most important step to take when integrating these OSINT feeds into their security monitoring?

   • AIngest all feeds into the SIEM without any filtering to ensure no potential threat is missed.
   • BUse the OSINT feeds only for manual threat hunting and not for automated alerting to avoid false positives.
   • CRely on a single, well-known OSINT feed to avoid the complexity of managing multiple sources.
   • DEstablish a process for regularly validating and de-duplicating the indicators from the feeds to ensure data quality and reduce noise.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A mid-sized healthcare organization wants to operationalize threat intelligence to improve its detection capabilities. The security team has a Splunk environment and has access to several OSINT feeds, including a list of known malicious C2 domains. The team's goal is to detect compromised hosts inside the network that are communicating with these C2 domains. What is the most effective way to operationalize this intelligence in Splunk?

   • AAdd the C2 domains to the firewall blocklist to prevent any communication with them.
   • BCreate a correlation search that matches DNS and proxy logs against the C2 domain lookup table and generates an alert when a match is found.
   • CStore the C2 domain list in a separate index and only query it when a specific incident is suspected.
   • DPublish the C2 domain list on the organization's internal wiki for analysts to reference during investigations.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the correct order of the threat intelligence lifecycle phases?

   • AAnalysis, Collection, Processing, Dissemination
   • BProcessing, Collection, Dissemination, Analysis
   • CCollection, Processing, Analysis, Dissemination
   • DDissemination, Analysis, Processing, Collection
   Reveal Solution Discussion Select an answer first