Integrate Threat Intelligence, Including All Aspects of the Lifecycle (evaluation, Curation, Maintenance, Sources, Confidence Scoring, Etc.), into Broader Security Operations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A threat intelligence team is curating indicators from multiple sources. They notice that some indicators are duplicates but have different confidence scores. They also notice that some indicators are outdated and no longer relevant. What is the best approach to curate this data?

   • AKeep all indicators as-is to avoid losing any potential intelligence.
   • BDeduplicate indicators but keep the highest confidence score for each.
   • CRetire all indicators that have a confidence score below 50.
   • DDeduplicate indicators, aggregate confidence scores, and retire outdated indicators.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In the threat intelligence lifecycle, which phase is primarily responsible for using feedback from consumers to improve future intelligence collection and analysis?

   • AFeedback
   • BAnalysis
   • CCollection
   • DDissemination
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is evaluating a new threat intelligence feed. The feed provides indicators that are highly relevant to the organization's industry, but the indicators are often incomplete, lacking context such as the type of threat or the affected systems. The analyst must decide whether to use this feed. What should the analyst do?

   • AUse the feed only for indicators that are complete.
   • BReject the feed because it is incomplete.
   • CUse the feed but supplement it with additional enrichment to improve completeness.
   • DUse the feed because relevance is the most important criterion.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which standard is specifically designed for the automated exchange of cyber threat intelligence in a structured format?

   • ASNMP
   • BDNS
   • CSTIX
   • DHTTP
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A threat intelligence team has completed the analysis phase and produced a report on a new threat actor. They need to ensure that the intelligence is used effectively in security operations. What should they do next in the lifecycle?

   • ADisseminate the intelligence to relevant stakeholders and integrate it into detection rules.
   • BWait for feedback from stakeholders before disseminating.
   • CCollect more data on the threat actor before sharing.
   • DArchive the report and move on to the next threat.
   Reveal Solution Discussion Select an answer first