Research, Incorporate and Develop Threat Intelligence. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company has experienced a series of phishing attacks that used similar tactics. The security team wants to develop custom threat intelligence to better detect future attacks. What is the best way to develop this intelligence?

   • AShare the incident details with competitors but not analyze them internally
   • BAnalyze email headers and URLs from past incidents to identify patterns and create indicators
   • CPurchase a generic phishing feed and use it as-is
   • DWait for the next attack to gather more data
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team wants to develop custom threat intelligence based on their own network traffic data. They have observed unusual outbound connections to a specific IP range. What is the best approach to turn this observation into actionable intelligence?

   • ACorrelate the observed IPs with other internal logs to identify patterns and potential indicators
   • BPublish the IPs on a public threat feed
   • CImmediately block the IP range without further analysis
   • DWait for a commercial feed to report the same IPs
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of a government-provided threat intelligence source?

   • AA public advisory from the Cybersecurity and Infrastructure Security Agency (CISA)
   • BA threat intelligence report shared by a peer organization in an industry information-sharing group
   • CAn internal threat intelligence database maintained by the organization's own security team
   • DA commercial threat feed from a private cybersecurity vendor
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A threat intelligence team wants to develop custom intelligence about emerging threats that may affect their industry. Which activity is most appropriate for this development?

   • AAnalyzing internal security logs for unusual patterns
   • BReviewing public vulnerability databases
   • CSubscribing to a vendor's threat alert service
   • DPurchasing a commercial threat intelligence feed
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security operations center (SOC) wants to improve its collection of threat intelligence on ransomware campaigns affecting healthcare organizations. They have a small team and need to stay current without overwhelming analysts. Which collection method is most effective for this goal?

   • AUse only internal incident data to identify ransomware trends
   • BRely on vendor threat reports published quarterly
   • CSubscribe to automated threat intelligence feeds from industry Information Sharing and Analysis Centers (ISACs)
   • DConduct manual research on dark web forums every week
   Reveal Solution Discussion Select an answer first