Integrate Threat Intelligence, Including All Aspects of the Lifecycle (evaluation, Curation, Maintenance, Sources, Confidence Scoring, Etc.), into Broader Security Operations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team wants to automate responses to high-confidence threat intelligence indicators. They have a SOAR platform that can block IPs and quarantine files. However, they are concerned about false positives causing disruption. What is the best approach to balance automation and risk?

   • AAutomate blocking for all indicators with a confidence score above 90.
   • BAutomate blocking only for indicators that are corroborated by multiple sources and have a high confidence score.
   • CDo not automate any responses; require manual approval for all actions.
   • DAutomate blocking for all indicators regardless of confidence.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which maintenance activity involves preserving historical intelligence data for future reference or analysis while removing it from active use?

   • ADeleting
   • BRetiring
   • CArchiving
   • DUpdating
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company wants to share threat intelligence with a partner organization, but they are concerned about exposing sensitive internal information. They want to share only indicators that are relevant to the partner and avoid sharing any proprietary context. What should they do?

   • AUse a sharing platform like MISP and configure sharing groups to limit the data shared with the partner.
   • BShare the indicators via email to avoid automated sharing.
   • CShare only indicators that have a confidence score above 90.
   • DShare all indicators and context with the partner to ensure maximum transparency.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which integration approach allows threat intelligence to be automatically compared against security events to generate alerts when a match is found?

   • AStatic threat intelligence reports
   • BPeriodic email summaries
   • CCorrelation rules in a SIEM
   • DManual review of intelligence reports
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security operations center (SOC) uses threat intelligence to enhance detection. They have a large number of indicators, but many are low confidence. The SOC wants to prioritize alerts so that analysts focus on the most critical threats first. What should they do?

   • ADisable alerts for low-confidence indicators entirely.
   • BCreate a single alert that triggers on any indicator match, regardless of confidence.
   • CManually review every indicator before creating an alert.
   • DUse confidence scores to prioritize alerts, with high-confidence indicators triggering immediate alerts and low-confidence indicators being logged for review.
   Reveal Solution Discussion Select an answer first