Research, Incorporate and Develop Threat Intelligence. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A security operations team wants to automatically enrich alerts with threat intelligence indicators. Which tool is most commonly used for this purpose?

   • AData loss prevention (DLP) system
   • BVulnerability scanner
   • CSIEM (Security Information and Event Management)
   • DPatch management tool
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team wants to enhance their SIEM with threat intelligence but has a limited budget. They need a source that provides a good balance of coverage and cost. Which source type is most appropriate?

   • AGovernment feeds only
   • BManual research only
   • COpen-source threat intelligence feeds
   • DCommercial feeds exclusively
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A multinational corporation operates in multiple regions and needs threat intelligence that covers different geographical threats. They have a moderate budget and want to ensure the intelligence is relevant to their specific industries. Which combination of sources would best meet their needs?

   • AOnly open-source feeds from a single country
   • BOnly internal incident data
   • CA mix of commercial feeds, industry ISACs, and government alerts
   • DOnly commercial feeds from one vendor
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A financial services company is evaluating threat intelligence sources to enhance its detection of emerging banking trojans. The team wants a source that provides timely, actionable indicators with minimal noise, but they have a limited budget for commercial feeds. Which approach best balances cost and relevance?

   • ABuild an in-house threat intelligence team to manually research all threats
   • BSubscribe to a commercial threat intelligence feed that specializes in financial malware
   • CRely solely on free open-source feeds like AlienVault OTX
   • DUse only government feeds such as US-CERT alerts
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team has developed custom threat intelligence based on internal incident data. They want to share this intelligence with other teams in the organization, but they are concerned about overwhelming them with too much information. What is the best way to disseminate this intelligence?

   • APublish the intelligence on the company's public website
   • BCreate a tiered dissemination plan that provides detailed intelligence to technical teams and summaries to management
   • CKeep the intelligence within the security team only
   • DSend the full intelligence report to all employees
   Reveal Solution Discussion Select an answer first