Research, Incorporate and Develop Threat Intelligence. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A company uses Splunk Enterprise Security (ES) and wants to incorporate external threat intelligence feeds to improve detection of malicious IP addresses. They have a list of IOCs from a commercial feed. What is the most effective way to integrate this intelligence into their SIEM?

   • AUse a SOAR playbook to block the IOCs at the firewall without any SIEM integration
   • BStore the IOCs in a text file and review them manually during investigations
   • CUpload the IOCs as a lookup table and create correlation searches that reference it
   • DManually add each IOC as a separate search alert
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A small cybersecurity team wants to stay informed about threats targeting their sector without dedicating excessive time to manual research. They have a limited budget and need to share findings with their executive team regularly. What is the most efficient collection method that also supports dissemination?

   • AHave each analyst manually research threats and present findings in a monthly meeting
   • BCreate a private chat group for analysts to share links informally
   • CSubscribe to automated feeds and set up a weekly digest email for executives
   • DUse only vendor threat reports and forward them to executives as-is
   Reveal Solution Discussion Select an answer first