Research, Incorporate and Develop Threat Intelligence. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A threat intelligence analyst wants to collect indicators of compromise (IOCs) from a trusted external source on a continuous basis. Which collection method is most appropriate for this task?

   • AManual research by analysts reading public reports and blogs
   • BAutomated feeds that push or pull IOCs into the organization's systems
   • CAd-hoc requests to other organizations for specific threat data
   • DCollaboration with industry groups through periodic meetings and emails
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A threat intelligence analyst has identified a critical vulnerability that affects a system in the organization. To support timely decision-making, which stakeholder should receive this intelligence first?

   • AThe organization's marketing department
   • BAll employees in the organization
   • CExternal customers
   • DThe IT operations team responsible for the affected system
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A threat intelligence team has produced a report on a new phishing campaign targeting the organization. What is the most important characteristic of the dissemination to ensure it supports decision-making?

   • AThe report is stored in a secure internal repository
   • BThe report is distributed to all employees, regardless of role
   • CThe report is delivered promptly to relevant stakeholders with clear, actionable recommendations
   • DThe report is written in technical jargon to ensure precision
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst has identified a critical vulnerability being exploited in the wild that affects a system used by the company. The analyst needs to inform the relevant stakeholders quickly. What is the most effective way to disseminate this threat intelligence?

   • AWait for the monthly security briefing to share the details
   • BCreate a ticket in the IT helpdesk system
   • CPost the information on the company's internal social media page
   • DSend a targeted email to the IT operations team and security management with a clear summary and recommended actions
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A security team wants to automate the response to a threat intelligence indicator, such as automatically blocking an IP address when it is observed in network traffic. Which tool is best suited for this automated response?

   • ASIEM
   • BVulnerability scanner
   • CFirewall
   • DSOAR (Security Orchestration, Automation, and Response)
   Reveal Solution Discussion Select an answer first