Integrate Threat Intelligence, Including All Aspects of the Lifecycle (evaluation, Curation, Maintenance, Sources, Confidence Scoring, Etc.), into Broader Security Operations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is considering using a community threat intelligence feed. The feed is free and provides a large number of indicators, but the team is concerned about the reliability of the indicators. They want to use the feed but mitigate the risk of false positives. What should they do?

   • AUse the feed as-is and trust the community's vetting process.
   • BUse the feed only for indicators that are also found in commercial feeds.
   • CReject the feed because community feeds are unreliable.
   • DUse the feed but apply a lower confidence score to its indicators.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team uses a threat intelligence platform that assigns confidence scores to indicators. They notice that indicators from a particular commercial feed consistently receive high scores, but several of these indicators have resulted in false positives. The team suspects the feed's scoring is inflated. What should they do to improve the accuracy of confidence scores?

   • AManually override the confidence score for each indicator from that feed.
   • BIncrease the confidence threshold for alerts.
   • CStop using the feed entirely.
   • DReduce the weight of that feed in the confidence scoring algorithm.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which curation process involves adding contextual information, such as threat actor attribution or MITRE ATT&CK techniques, to raw indicators to make them more actionable?

   • AFiltering
   • BEnrichment
   • CDeduplication
   • DNormalization
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A threat intelligence repository contains an indicator that was associated with a specific malware campaign. The campaign has been inactive for six months, and the indicator has not been observed in any recent detections. The team wants to maintain the repository's accuracy. What should they do with this indicator?

   • AArchive the indicator and remove it from active detection.
   • BIncrease the confidence score to keep it active.
   • CKeep the indicator active because it may become relevant again.
   • DDelete the indicator permanently.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team maintains a threat intelligence repository that is used to block malicious domains. They notice that some domains are being blocked but are no longer malicious, causing legitimate users to be affected. The team wants to reduce these false positives while maintaining security. What should they do?

   • AKeep all domains in the blocklist to ensure maximum security.
   • BImmediately remove all domains that have not been seen in the last 30 days.
   • CLower the confidence score of all domains to reduce blocking.
   • DReview the domains and retire those that are no longer considered malicious, while archiving them for reference.
   Reveal Solution Discussion Select an answer first