312-85 Threat Intelligence IN SOC IR And Risk Management — 20 Questions

Question 1

When using IBM QRadar Incident Forensics, you identify an ongoing data exfiltration attempt. To integrate external TI feeds for automated IOC blocking, which configuration tab in the QRadar Log Activity app allows for immediate watchlist creation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Offenses. The 'Offenses' tab in QRadar allows users to create watchlists or update Reference Sets directly from event data that has been enriched by threat intelligence feeds.

Answer

Deployment Editor

Answer

Log Activity

Answer

Asset Profile

Question 2

A SOC analyst needs to verify if an IP address flagged by a TI feed is a known Tor exit node. Which category of threat intelligence is this information considered?

Accepted Answer

Technical. Operational intelligence provides immediate, actionable data like IP addresses or file hashes to support SOC operations.

Answer

Strategic

Answer

Operational

Answer

Tactical

Question 3

You are using ThreatConnect to prioritize indicators. Which scoring metric is automatically calculated based on the confidence level of the source and the age of the indicator?

Accepted Answer

Threat Rating. ThreatConnect utilizes the 'Threat Rating' which is a composite score derived from source confidence and the recency of the data.

Answer

CVSS Score

Answer

Impact Factor

Answer

Risk Appetite

Question 4

In Palo Alto Networks Cortex XSOAR, you are building a playbook to automate the qualification of incoming phishing alerts. Which integration command is used to calculate a 'reputation score' based on data from a connected threat intelligence platform (TIP)?

Accepted Answer

!getIndicatorScore. The '!getIndicatorScore' command is the standard XSOAR automation command used to fetch and aggregate reputation scores from all integrated threat intelligence sources.

Answer

!fetchIntel

Answer

!updateReputation

Answer

!queryTI

Question 5

When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?

Accepted Answer

Planning and Direction. The 'Planning and Direction' phase defines the requirements, including identifying which threat actors are relevant to the organization's risk profile.

Answer

Dissemination

Answer

Processing

Answer

Collection

Question 6

You are managing a CrowdStrike Falcon Insight deployment. To proactively hunt for an adversary identified in a recent TI report, which search language should you use to query the Event Search interface for a specific file hash?

Accepted Answer

FQL. CrowdStrike utilizes FQL (Falcon Query Language) to search across the sensor data and endpoint activity logs.

Answer

SPL

Answer

KQL

Answer

Lucene

Question 7

You are setting up a TAXII server for threat intelligence sharing. Which component of the STIX 2.1 specification defines the relationship between a threat actor and the infrastructure they use?

Accepted Answer

Relationship. The 'Relationship' object in STIX 2.1 is used to define how SDOs (STIX Domain Objects) interact, such as a Threat Actor 'uses' an Infrastructure object.

Answer

Indicator

Answer

Sighting

Answer

Identity

Question 8

You are configuring a Splunk Enterprise Security (ES) Threat Intelligence Framework to ingest STIX data. Which specific lookup table must be populated to enable the 'Threat Activity' dashboard to correlate external indicators with internal notable events?

Accepted Answer

threat_intel_by_str. The 'threat_intel_by_str' lookup table is the primary repository for normalized threat intelligence data that Splunk ES uses for correlation across its dashboards.

Answer

assets_by_cidr

Answer

threat_group_mapping

Answer

notable_events_summary

Question 9

You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the industry-standard framework for mapping adversarial techniques and identifying gaps in security controls.

Answer

STRIDE

Answer

OSINT

Answer

CVSS

Question 10

In Microsoft Sentinel, you are tasked with creating a hunting query to detect 'Living off the Land' techniques. Which KQL operator allows you to join TI indicator data with device logs?

Accepted Answer

join. The 'join' operator in KQL is required to correlate disparate datasets, such as threat intelligence logs and security event logs.

Answer

merge

Answer

lookup

Answer

union

Question 11

During an IR engagement, you observe a beaconing pattern to a suspicious domain. Which tool feature in Wireshark would you use to export domain names for further analysis against your TI feed?

Accepted Answer

Export Objects. 'Export Objects' allows you to extract HTTP or DNS data, including domain names, from a PCAP file.

Answer

Follow TCP Stream

Answer

Endpoints

Answer

Expert Information

Question 12

Your management team requires a high-level summary of the threat landscape to inform budget allocation. Which type of threat intelligence report should you provide?

Accepted Answer

Strategic. Strategic intelligence is designed for executive audiences to understand trends and risk posture over time.

Answer

Technical

Answer

Operational

Answer

Tactical

Question 13

You are reviewing a threat intelligence report regarding a new malware variant. Which section of the report is most critical for your incident responders to identify local presence of the infection?

Accepted Answer

Indicators of Compromise. The Indicators of Compromise (IOC) section provides the specific hashes, IPs, and file paths needed for immediate detection.

Answer

Threat Actor Attribution

Answer

Mitigation Strategy

Answer

Executive Summary

Question 14

Which of the following is a primary 'push' source for threat intelligence in an enterprise SOC?

Accepted Answer

Commercial threat feed. A commercial threat intelligence platform (TIP) or feed is typically a 'push' source, providing updates to the enterprise as they are identified.

Answer

Internal log analysis

Answer

Packet capture

Answer

Manual web research

Question 15

You are configuring a SIEM to ingest STIX/TAXII feeds. What is the benefit of setting an 'Expiration' time on ingested indicators?

Accepted Answer

Reduces false positives from stale indicators. Setting an expiration period ensures that stale or obsolete indicators are removed, which reduces false positives and improves correlation performance.

Answer

Increases ingestion speed

Answer

Decreases storage costs

Answer

Complies with GDPR

Question 16

You are configuring a firewall to block domains identified by your TI platform. What is the primary risk of using 'automated blocking' without human verification?

Accepted Answer

Blocking legitimate business traffic. The primary risk of automated blocking is the potential for blocking legitimate services, leading to business disruption due to false positives.

Answer

Increased malware infection rate

Answer

Overloading the SIEM

Answer

Higher license costs

Question 17

Which THREE factors should be considered when assessing the 'relevance' of a threat intelligence feed for your organization?

Accepted Answer

Industry vertical focus. Relevance is determined by the industry vertical, the geographical footprint of the organization, and the specific technology stack in use.

Answer

Number of API calls

Answer

Cost of the feed

Question 18

In a threat intelligence lifecycle, what is the specific role of the 'Dissemination' phase in relation to the IR team?

Accepted Answer

Delivering intelligence in a usable, timely format. Dissemination ensures that relevant, actionable intelligence reaches the IR team in a format they can immediately use for investigation.

Answer

Defining incident response procedures

Answer

Validating the data source reliability

Answer

Archiving incident data

Question 19

Which TWO types of intelligence are most essential for an Incident Response team during an active attack investigation?

Accepted Answer

Tactical Intelligence. Tactical and Operational intelligence are essential for responding to live incidents. Tactical details the TTPs, while Operational provides the immediate indicators.

Answer

Regulatory Intelligence

Answer

Market Intelligence

Answer

Strategic Intelligence

Question 20

Which THREE types of information should be collected during the 'Processing' phase of the intelligence cycle to ensure data quality?

Accepted Answer

Enrichment with context. Data quality is ensured by normalizing formats, removing duplicates, and enriching data with context from other sources.

Answer

Physical media scanning

Answer

Executive sign-off