Research, Incorporate and Develop Threat Intelligence. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company uses Splunk ES and wants to integrate a new threat intelligence feed. The feed provides indicators in STIX/TAXII format, but the team is unfamiliar with this format. They need to automate the ingestion and ensure the indicators are used in detection. What is the best approach?

   • AUse a Splunk add-on or custom script to parse STIX/TAXII and populate a lookup table
   • BIgnore the feed because STIX/TAXII is not supported by Splunk
   • CUse a SOAR playbook to manually copy indicators into Splunk ES
   • DManually convert the STIX/TAXII data to CSV and upload it weekly
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A threat intelligence analyst is evaluating a report about a new zero-day vulnerability. The report was published six months ago, and the vendor has already released a patch. Which evaluation criterion is most important to consider when deciding whether to act on this intelligence?

   • AAccuracy
   • BRelevance
   • CTimeliness
   • DSource credibility
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat intelligence analyst is reviewing a new feed that provides indicators for a specific malware family. The feed has a high volume of indicators, but many are duplicates or have been seen in other feeds. The analyst wants to ensure the intelligence is useful. What is the most important factor to evaluate?

   • AThe accuracy and uniqueness of the indicators
   • BThe color scheme of the feed's website
   • CThe number of indicators in the feed
   • DThe feed's update frequency only
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A threat intelligence team wants to share information about a new phishing campaign with other organizations in the same sector. Which collection method is most appropriate for this collaborative sharing?

   • AAutomated feeds from a commercial vendor
   • BParticipation in an industry Information Sharing and Analysis Center (ISAC)
   • CInternal analysis of the organization's own security logs
   • DManual research using public search engines
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team wants to collect threat intelligence on a new ransomware group that is targeting their region. They have a small budget and need to act quickly. They are considering joining a local ISAC, subscribing to a commercial feed, and conducting manual research. Which approach is most effective given the constraints?

   • AOnly conduct manual research on dark web forums
   • BJoin the local ISAC and subscribe to a commercial feed
   • COnly join the local ISAC
   • DOnly subscribe to a commercial feed
   Reveal Solution Discussion Select an answer first