Research, Incorporate and Develop Threat Intelligence. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A threat intelligence analyst is evaluating a new feed that claims to provide early warning of zero-day exploits. The feed has a high reputation but has not been used by the organization before. The analyst needs to decide whether to integrate this feed into their SIEM. What is the most important consideration?

   • AThe feed's popularity among other security teams
   • BThe feed's update frequency, even if the indicators are unverified
   • CThe feed's track record for accuracy and its relevance to the organization's technology stack
   • DThe feed's cost, regardless of quality
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst is evaluating two threat intelligence feeds. Feed A provides a high volume of indicators with frequent updates but has a high false-positive rate. Feed B provides fewer indicators but is highly accurate and specific to the organization's industry. The analyst needs to reduce alert fatigue while maintaining detection coverage. Which feed should the analyst prioritize?

   • AFeed B, because accuracy and relevance are more important than volume
   • BFeed A, because more indicators mean better coverage
   • CUse Feed A for detection and Feed B for reporting only
   • DUse both feeds equally without filtering
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst receives a threat intelligence report from an open-source feed indicating a new malware family is targeting the company's industry. The report includes indicators of compromise (IOCs) but lacks context on the malware's behavior. The analyst has limited time and must decide whether to act. What should the analyst do first?

   • AImmediately block all the IOCs in the firewall
   • BEvaluate the source's credibility and the relevance of the IOCs to the company's environment
   • CShare the report with all employees to raise awareness
   • DIgnore the report because it is from an open-source feed
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is building a threat intelligence program from scratch. They have a limited budget and need to cover a wide range of threats. They are considering using open-source feeds, commercial feeds, and government alerts. Which strategy is most effective for building a sustainable program?

   • AUse only government feeds and ignore open-source and commercial
   • BInvest heavily in commercial feeds from the start
   • CStart with open-source and government feeds, then add commercial feeds as budget allows
   • DBuild a custom intelligence platform before collecting any feeds
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team uses a SOAR platform to automate incident response. They want to incorporate threat intelligence from a commercial feed to automatically enrich alerts and trigger response actions. What is the best way to integrate this intelligence?

   • AManually copy indicators from the feed into each incident
   • BBlock all IPs from the feed at the firewall without validation
   • CUse the feed only for reporting, not for automation
   • DConfigure a SOAR playbook that queries the threat intelligence feed and enriches incident data
   Reveal Solution Discussion Select an answer first