A company wants to share threat intelligence with a trusted partner organization. They need a standardized format and a transport mechanism that supports automated sharing. Which combination should they use?

JSON for the format and REST API for the transport.

MISP for the format and email for the transport.

STIX for the format and TAXII for the transport.

CSV for the format and SFTP for the transport.

A threat intelligence repository contains indicators that were added over the past year. Some indicators are no longer considered malicious by the community, and others have not been seen in any detection for months. The team wants to keep the repository accurate and reduce false positives. What should they do?

Keep all indicators in the repository indefinitely to ensure no threat is missed.

Increase the confidence score of all indicators to ensure they are not retired.

Delete all indicators that have not triggered an alert in the last 30 days.

Retire indicators that are no longer considered malicious and archive indicators that have not been seen recently.

A security team wants to operationalize threat intelligence by mapping indicators to MITRE ATT&CK techniques. They have a large number of indicators and want to prioritize alerts based on the techniques they represent. What should they do?

Map each indicator to a technique and prioritize alerts based on the prevalence of that technique in their environment.

Ignore the mapping and prioritize alerts based on the confidence score alone.

Create a separate alert for each indicator without mapping to techniques.

Prioritize alerts based solely on the number of indicators for each technique.

SplunkCertified Cybersecurity Defense Architect

Domain 1Objective 2

Integrate Threat Intelligence, Including All Aspects of the Lifecycle (evaluation, Curation, Maintenance, Sources, Confidence Scoring, Etc.), into Broader Security Operations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Part of the Advanced Threat Intelligence and Analysis domain, which accounts for 5% of the CYBERSECURITY-DEFENSE-ARCHITECT exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~2–3 in this domain), expect 1–1 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

5%of the exam

9 Concepts in This Objective

Threat Intelligence Lifecycle Overview
Threat Intelligence Sources
Threat Intelligence Evaluation
Threat Intelligence Curation
Threat Intelligence Maintenance
Threat Intelligence Confidence Scoring
Integration into Security Operations
Threat Intelligence Sharing and Collaboration
Operationalizing Threat Intelligence

Questions 16–20

16foundation · easy
Which phase of the threat intelligence lifecycle involves transforming raw collected data into a structured format that can be analyzed for indicators of compromise?
Select an answer first
17application · medium
A company wants to share threat intelligence with a trusted partner organization. They need a standardized format and a transport mechanism that supports automated sharing. Which combination should they use?
Select an answer first
18application · medium
A threat intelligence repository contains indicators that were added over the past year. Some indicators are no longer considered malicious by the community, and others have not been seen in any detection for months. The team wants to keep the repository accurate and reduce false positives. What should they do?
Select an answer first
19foundation · easy
Which criterion for evaluating a threat intelligence feed assesses whether the information is current enough to be useful for detecting active threats?
Select an answer first
20application · medium
A security team wants to operationalize threat intelligence by mapping indicators to MITRE ATT&CK techniques. They have a large number of indicators and want to prioritize alerts based on the techniques they represent. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ARCHITECT” is a trademark of its owner, used for identification only.

Integrate Threat Intelligence, Including All Aspects of the Lifecycle (evaluation, Curation, Maintenance, Sources, Confidence Scoring, Etc.), into Broader Security Operations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

Which phase of the threat intelligence lifecycle involves transforming raw collected data into a structured format that can be analyzed for indicators of compromise?

A company wants to share threat intelligence with a trusted partner organization. They need a standardized format and a transport mechanism that supports automated sharing. Which combination should they use?

Which criterion for evaluating a threat intelligence feed assesses whether the information is current enough to be useful for detecting active threats?

A security team wants to operationalize threat intelligence by mapping indicators to MITRE ATT&CK techniques. They have a large number of indicators and want to prioritize alerts based on the techniques they represent. What should they do?

Keep studying — Advanced Threat Intelligence and Analysis