Integrate Threat Intelligence, Including All Aspects of the Lifecycle (evaluation, Curation, Maintenance, Sources, Confidence Scoring, Etc.), into Broader Security Operations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   During an incident response, how can threat intelligence be used to enhance the investigation?

   • ABy guaranteeing the attack will not recur
   • BBy replacing the need for forensic analysis
   • CBy automatically remediating all affected systems without human intervention
   • DBy providing context about the threat actor, tactics, and potential scope of the attack
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security team receives a large volume of raw threat intelligence from multiple sources. They want to ensure that the intelligence used in their security operations is actionable and not redundant. What should they do?

   • AStore all raw intelligence in a data lake for future analysis.
   • BAutomatically block all indicators from all sources.
   • CUse only the feed with the highest volume of indicators.
   • DApply a curation process that filters, enriches, and deduplicates the intelligence.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   How should a security analyst interpret a threat intelligence indicator with a low confidence score?

   • AAs a high-priority alert that should be escalated immediately
   • BAs a false positive that should be ignored
   • CAs an indicator that requires additional verification before acting
   • DAs a definitive indicator of compromise that requires immediate action
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which platform is commonly used by organizations to share threat intelligence within a community or consortium?

   • ANessus
   • BWireshark
   • CMISP
   • DSplunk
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is reviewing a threat intelligence report that includes an indicator with a confidence score of 80 out of 100. The indicator was provided by a single, relatively unknown source and has not been corroborated by any other feed. The analyst is considering whether to block the indicator. What should the analyst do?

   • ALower the confidence score to reflect the lack of corroboration and treat the indicator as low priority.
   • BIgnore the indicator because it is from an unknown source.
   • CBlock the indicator immediately because the confidence score is above 75.
   • DBlock the indicator but only for a limited time to see if it causes issues.
   Reveal Solution Discussion Select an answer first