Integrate Threat Intelligence, Including All Aspects of the Lifecycle (evaluation, Curation, Maintenance, Sources, Confidence Scoring, Etc.), into Broader Security Operations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which factor is commonly used to assign a confidence score to a threat intelligence indicator?

   • AThe color of the indicator in the threat intelligence platform
   • BThe number of characters in the threat actor's name
   • CThe length of the indicator string
   • DThe source reliability and corroboration from multiple sources
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of mapping threat intelligence to the MITRE ATT&CK framework?

   • ATo automatically block all malicious IP addresses
   • BTo standardize the format of threat intelligence feeds
   • CTo understand the tactics and techniques used by threat actors
   • DTo replace the need for threat intelligence feeds
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A SOC wants to integrate threat intelligence into their SIEM to reduce alert fatigue. They have a mix of high-confidence and low-confidence indicators. The SOC wants to ensure that high-confidence indicators trigger immediate alerts, while low-confidence indicators are used for enrichment during investigations. What is the best approach?

   • ACreate two separate correlation searches: one for high-confidence indicators that triggers alerts, and one for low-confidence indicators that adds context to events.
   • BCreate a single correlation search that triggers alerts on any indicator match.
   • CManually review all alerts to determine which are high-confidence.
   • DUse only high-confidence indicators in the SIEM and ignore low-confidence ones.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   When evaluating a threat intelligence feed, which criterion is used to determine if the indicators are directly applicable to the organization's industry, infrastructure, and threat model?

   • ACompleteness
   • BTimeliness
   • CRelevance
   • DAccuracy
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of retiring indicators in a threat intelligence repository?

   • ATo comply with data retention regulations
   • BTo remove indicators that are no longer relevant or have expired
   • CTo make the repository easier to search
   • DTo reduce the storage space required for the repository
   Reveal Solution Discussion Select an answer first