Research, Incorporate and Develop Threat Intelligence. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst discovers a new command-and-control (C2) domain used by a threat actor targeting the company. The analyst needs to inform the network team and the incident response team. What is the most effective way to disseminate this intelligence?

   • AWait for the next threat intelligence meeting to discuss it
   • BAdd the domain to a shared spreadsheet and hope someone notices
   • CSend an urgent alert with the domain and recommended blocking actions to the relevant teams
   • DPost it on the company's public website
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A threat intelligence analyst is tasked with developing custom threat intelligence for the organization. Which internal data source would be most valuable for this purpose?

   • AEmployee performance reviews
   • BPublicly available threat reports from vendors
   • CMarketing data about customer preferences
   • DHistorical security incident reports and investigation findings
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security operations center has integrated a new threat intelligence feed into their SIEM. The feed generates a high number of alerts, many of which are false positives. The SOC manager wants to reduce alert fatigue while still leveraging the intelligence. What is the best approach?

   • AIncrease the alert severity to force analysts to review them
   • BDisable the feed entirely to stop the alerts
   • CTune the correlation searches to require additional context, such as asset criticality or user risk
   • DIgnore the alerts and rely on manual review of the feed
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security analyst is categorizing threat intelligence sources for a new threat intelligence program. Which of the following is an example of an external open-source threat intelligence feed?

   • AA vendor-specific malware analysis report shared under a non-disclosure agreement
   • BA threat feed purchased from a commercial vendor that requires a paid subscription
   • CA public blog post from a security researcher detailing a newly discovered exploit technique
   • DAn internal incident report from the organization's own security operations center
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A threat intelligence analyst receives a report about a malware campaign that targets a specific type of industrial control system (ICS) software. The organization does not use that software. Which aspect of the intelligence should the analyst primarily consider when evaluating its applicability?

   • ASource reliability
   • BTimeliness
   • CAccuracy
   • DRelevance
   Reveal Solution Discussion Select an answer first