Develop and Implement Customized Threat Intelligence Strategies, Including Both Open Source and Commercial Intelligence Providers. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   During which phase of the threat intelligence lifecycle is raw data transformed into a structured format suitable for analysis?

   • AAnalysis
   • BDissemination
   • CCollection
   • DProcessing
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When evaluating a commercial threat intelligence provider, which factor is most important to consider?

   • AThe provider's marketing materials and promotional offers
   • BThe provider's brand recognition in the security industry
   • CThe number of employees the provider has
   • DThe coverage of the provider's intelligence against the organization's specific threat landscape
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A technology company is evaluating a commercial threat intelligence provider. The provider offers a feed of IoCs, but the company's security team is concerned about the quality of the data. They want to assess the provider's data quality before committing to a subscription. Which of the following is the most effective way to evaluate the quality of the provider's feed?

   • ARun a proof-of-concept (PoC) by ingesting a sample of the feed into a test environment and measuring the false positive rate against known benign traffic.
   • BAsk other companies in the industry for their opinions on the provider's feed.
   • CReview the provider's marketing materials and case studies to understand the quality of their data.
   • DCompare the provider's feed to a list of known IoCs from public sources to see if they match.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company's SOC has integrated a threat intelligence feed into its Splunk environment. The feed contains indicators of compromise (IoCs) such as malicious IPs and hashes. The SOC wants to use this intelligence to proactively hunt for threats in their environment. Which of the following is the most effective way to use the intelligence for threat hunting?

   • ACreate a dashboard that displays the IoCs from the feed for analysts to review manually.
   • BAdd the IoCs to a blocklist on the firewall to prevent any communication with the malicious IPs.
   • CRun a series of hunting searches that look for matches between the IoCs in the feed and the company's historical and current log data.
   • DShare the IoCs with other organizations in the industry to help them improve their defenses.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary benefit of integrating open source threat intelligence (OSINT) feeds into a security program?

   • AThey guarantee the highest quality and most accurate threat indicators
   • BThey eliminate the need for commercial intelligence providers
   • CThey offer a cost-effective way to obtain a broad range of threat data
   • DThey provide exclusive access to classified government intelligence
   Reveal Solution Discussion Select an answer first