A security operations team is evaluating two new threat intelligence feeds. Feed A provides a high volume of indicators with a 24-hour delay and is sourced from a well-known commercial vendor. Feed B provides a smaller volume of indicators in near real-time, sourced from a community of vetted analysts. The team needs to prioritize alerts for immediate action. Which feed should the team prioritize for real-time alerting, and why?

Feed B, because community-sourced feeds are always more accurate than commercial feeds.

Feed A, because a higher volume of indicators ensures better coverage of threats.

Feed A, because commercial feeds are generally more reliable than community feeds.

Feed B, because it provides more timely indicators, which is critical for immediate action.

SplunkCertified Cybersecurity Defense Architect

Domain 1Objective 2

Integrate Threat Intelligence, Including All Aspects of the Lifecycle (evaluation, Curation, Maintenance, Sources, Confidence Scoring, Etc.), into Broader Security Operations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Part of the Advanced Threat Intelligence and Analysis domain, which accounts for 5% of the CYBERSECURITY-DEFENSE-ARCHITECT exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~2–3 in this domain), expect 1–1 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

5%of the exam

9 Concepts in This Objective

Threat Intelligence Lifecycle Overview
Threat Intelligence Sources
Threat Intelligence Evaluation
Threat Intelligence Curation
Threat Intelligence Maintenance
Threat Intelligence Confidence Scoring
Integration into Security Operations
Threat Intelligence Sharing and Collaboration
Operationalizing Threat Intelligence

Questions 11–15

11foundation · easy
Which operationalization process uses threat intelligence to rank alerts based on the likelihood that they represent a real threat?
Select an answer first
12foundation · easy
An organization wants to enrich its threat intelligence with data from its own firewall logs, endpoint detections, and past incident reports. Which threat intelligence source category does this represent?
Select an answer first
13foundation · easy
Which type of threat intelligence source is typically maintained by a vendor or provider and requires a subscription or purchase to access?
Select an answer first
14foundation · easy
During threat intelligence curation, which process is used to remove duplicate indicators that appear in multiple feeds to reduce noise and improve data quality?
Select an answer first
15application · medium
A security operations team is evaluating two new threat intelligence feeds. Feed A provides a high volume of indicators with a 24-hour delay and is sourced from a well-known commercial vendor. Feed B provides a smaller volume of indicators in near real-time, sourced from a community of vetted analysts. The team needs to prioritize alerts for immediate action. Which feed should the team prioritize for real-time alerting, and why?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ARCHITECT” is a trademark of its owner, used for identification only.

Integrate Threat Intelligence, Including All Aspects of the Lifecycle (evaluation, Curation, Maintenance, Sources, Confidence Scoring, Etc.), into Broader Security Operations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

Which operationalization process uses threat intelligence to rank alerts based on the likelihood that they represent a real threat?

An organization wants to enrich its threat intelligence with data from its own firewall logs, endpoint detections, and past incident reports. Which threat intelligence source category does this represent?

Which type of threat intelligence source is typically maintained by a vendor or provider and requires a subscription or purchase to access?

During threat intelligence curation, which process is used to remove duplicate indicators that appear in multiple feeds to reduce noise and improve data quality?

Keep studying — Advanced Threat Intelligence and Analysis