312-85 Threat Intelligence IN SOC IR And Risk Management — All Questions With Answers

Question 1mediummultiple choice

Read the full Ansible explanation →

In Palo Alto Networks Cortex XSOAR, you are building a playbook to automate the qualification of incoming phishing alerts. Which integration command is used to calculate a 'reputation score' based on data from a connected threat intelligence platform (TIP)?

Question 2mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

When using IBM QRadar Incident Forensics, you identify an ongoing data exfiltration attempt. To integrate external TI feeds for automated IOC blocking, which configuration tab in the QRadar Log Activity app allows for immediate watchlist creation?

Question 3hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are managing a CrowdStrike Falcon Insight deployment. To proactively hunt for an adversary identified in a recent TI report, which search language should you use to query the Event Search interface for a specific file hash?

Question 4hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are setting up a TAXII server for threat intelligence sharing. Which component of the STIX 2.1 specification defines the relationship between a threat actor and the infrastructure they use?

Question 5mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are configuring a Splunk Enterprise Security (ES) Threat Intelligence Framework to ingest STIX data. Which specific lookup table must be populated to enable the 'Threat Activity' dashboard to correlate external indicators with internal notable events?

Question 6easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst needs to verify if an IP address flagged by a TI feed is a known Tor exit node. Which category of threat intelligence is this information considered?

Question 7mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

During an IR engagement, you observe a beaconing pattern to a suspicious domain. Which tool feature in Wireshark would you use to export domain names for further analysis against your TI feed?

Question 8hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are using ThreatConnect to prioritize indicators. Which scoring metric is automatically calculated based on the confidence level of the source and the age of the indicator?

Question 9mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which TWO types of intelligence are most essential for an Incident Response team during an active attack investigation?

Question 10hardmulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which TWO protocols are most commonly used for the automated exchange of threat intelligence between different organizations or platforms?

Question 11mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst receives a high-confidence indicator of compromise (IOC) from a trusted ISAC: a SHA-256 hash of a malicious binary. The organization's endpoint detection and response (EDR) solution supports automated response actions. The analyst wants to immediately block this hash across all endpoints. Which action should the analyst take first according to threat intelligence best practices?

Question 12hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is preparing a report for the SOC manager after a ransomware incident. The analyst has external feeds indicating the ransomware group's TTPs, internal logs showing initial access via a phishing attachment, and a risk assessment showing the affected business unit has a low tolerance for downtime. Which combination of intelligence types should the analyst prioritize to directly support the SOC's future detection and response efforts?

Question 13mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is preparing to share indicators of compromise (IOCs) with a partner organization. To ensure the sharing is effective and secure, which two considerations are most important according to threat intelligence sharing best practices? (Choose two.)

Question 14mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is evaluating a new external feed for integration into the SOC's detection stack. The feed provides indicators of compromise (IOCs) with varying confidence levels and includes some outdated IP addresses. The analyst must decide which criteria are most important to assess before operationalizing the feed. (Choose two.)

Question 15mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst is using threat intelligence to enhance the incident response process. The analyst wants to integrate intelligence into the IR lifecycle to improve detection, containment, and recovery. Which two actions best leverage threat intelligence during the containment phase of an incident? (Choose two.)

Question 16easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?

Question 17mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?

Question 18mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

In Microsoft Sentinel, you are tasked with creating a hunting query to detect 'Living off the Land' techniques. Which KQL operator allows you to join TI indicator data with device logs?

Question 19easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Your management team requires a high-level summary of the threat landscape to inform budget allocation. Which type of threat intelligence report should you provide?

Question 20mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are reviewing a threat intelligence report regarding a new malware variant. Which section of the report is most critical for your incident responders to identify local presence of the infection?

Question 21easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which of the following is a primary 'push' source for threat intelligence in an enterprise SOC?

Question 22hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are configuring a SIEM to ingest STIX/TAXII feeds. What is the benefit of setting an 'Expiration' time on ingested indicators?

Question 23mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are configuring a firewall to block domains identified by your TI platform. What is the primary risk of using 'automated blocking' without human verification?

Question 24mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which THREE factors should be considered when assessing the 'relevance' of a threat intelligence feed for your organization?

Question 25hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

In a threat intelligence lifecycle, what is the specific role of the 'Dissemination' phase in relation to the IR team?

Question 26mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which THREE types of information should be collected during the 'Processing' phase of the intelligence cycle to ensure data quality?

Question 27hardmulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which TWO components are mandatory for a valid STIX 2.1 'Indicator' object to function within an automated ingestion system?

Question 28mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which THREE actions should a SOC team perform when a high-confidence indicator is received via a threat intelligence feed?

Question 29hardmulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which TWO aspects of a threat intelligence report are most useful for long-term strategic risk management decisions?

Question 30easymulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which THREE of the following are considered 'Internal' sources of threat intelligence for a SOC?

Question 31hardmulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst is building a risk-based alert prioritization model in their SIEM. They want to enrich incoming alerts with threat intelligence that reflects the organization's specific business context. Which TWO data sources should be integrated into the risk scoring to achieve this? (Choose two.)

Question 32mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is supporting an incident response team during an active ransomware outbreak. The IR team needs to know if the ransomware strain has been observed using a specific lateral movement technique. Which action should the analyst take to provide the most actionable intelligence?

Question 33easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC manager is defining the intelligence requirements for the incident response team. The team wants to receive threat intelligence that helps them quickly determine the scope of a potential breach. Which type of intelligence best supports this need?

Question 34mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

During an active ransomware incident, your SOC manager asks you to quickly determine whether the malware family has known lateral movement capabilities against Windows environments. Which threat intelligence product best supports this immediate need?

Question 35hardmulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are building a threat intelligence program for a SOC and must define processes for the 'Direction' phase of the intelligence lifecycle. Which two activities belong to this phase? (Choose two.)

Question 36mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Your SOC has just onboarded a new premium threat intelligence feed that delivers atomic indicators with a confidence score of 85. During the first week, analysts notice that 40% of the IP addresses in the feed are sinkholed by the vendor but still resolve to live infrastructure in your environment. You need to configure your SIEM to ingest these indicators while minimizing false positives from sinkholed addresses. What should you do first?

Question 37easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst receives a threat intelligence report indicating that a new phishing campaign is targeting your industry with a specific malicious domain. The analyst wants to quickly check if any internal hosts have communicated with that domain. Which action should the analyst take first?

Question 38hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is integrating a new external feed into the organization's SIEM. The feed provides indicators with varying confidence levels. The analyst must ensure that only high-confidence indicators trigger automated alerts to reduce false positives. Which component of the intelligence lifecycle is most directly involved in this filtering process?

Question 39mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are the CTI lead at a hospital network. Your SOC receives a vendor report stating that a ransomware group is actively targeting healthcare providers in your region with a new encryptor. Your CISO asks what the FIRST action should be to convert this intelligence into operational value for the SOC. What do you do?

Question 40hardmultiple choice

Study the full IPv6 explanation →

You are a threat intelligence analyst supporting a SOC. The SOC uses a SIEM that ingests indicators from multiple feeds. You notice that a high-priority indicator from a trusted feed is not generating alerts. After investigation, you find the indicator is an IPv6 address, but the SIEM's ingestion parser only supports IPv4. What is the most appropriate action to improve the intelligence program?

Question 41easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A junior analyst is tasked with creating a report for the SOC manager on the current threat landscape. The analyst has collected data from various sources, including open-source reports, internal incident tickets, and premium feeds. Which phase of the threat intelligence lifecycle should the analyst focus on to ensure the report is tailored to the organization's specific needs?

Question 42hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

During an active incident, your IR team needs to know whether a specific IP address is a known C2 node. Your TI platform returns a confidence score of 95 with a first-seen date of 14 months ago. What is the most appropriate way to use this intelligence in the IR decision-making process?

Question 43mediummultiple choice

Read the full VPN explanation →

A risk manager asks you to provide threat intelligence that helps prioritize patching efforts for a newly disclosed vulnerability in your internet-facing VPN appliance. Which type of intelligence is most relevant for this request?

Question 44easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Your organization's SOC is drowning in alerts, and the CISO wants to reduce noise using threat intelligence. Which approach best applies TI to prioritize alerts during triage?

Question 45mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Your SOC is building a threat intelligence program and the CISO asks which outputs should be delivered to the risk management team to support enterprise risk decisions. (Choose two.)

Question 46mediummultiple choice

Read the full DNS explanation →

A SOC analyst receives a threat intelligence report indicating that a specific APT group is targeting the organization's industry with a new malware family that uses DNS tunneling for command and control. The analyst wants to create a detection rule in the SIEM to identify this activity. Which data source and detection logic would be most effective?

Question 47hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Your organization uses a commercial TI platform that ingests multiple feeds. During an incident review, you notice that one feed consistently produces indicators that later turn out to be benign cloud provider IP ranges. What is the most appropriate corrective action to improve the intelligence program?

Question 48easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is asked to support the incident response team during an active investigation of a suspected compromise. The IR team needs to know whether the observed IP address 203.0.113.45 is associated with any known threat actor. Which action should the analyst take first?

Question 49mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst is triaging a suspected intrusion and receives a threat intelligence report that contains a list of adversary tactics, techniques, and procedures (TTPs) from a known APT group. The analyst wants to map these TTPs to the MITRE ATT&CK framework to identify gaps in detection coverage. Which type of threat intelligence is the analyst primarily using?

Question 50hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is integrating a new feed into the SOC's SIEM. The feed provides indicators with a confidence score of 75. The analyst notices that some indicators are six months old and have not been observed recently. According to best practices for threat intelligence in SOC operations, what should the analyst do first to ensure effective alerting?

Question 51mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC manager is reviewing the incident response process and wants to ensure that threat intelligence is effectively used during an active incident. The manager asks the analyst to provide intelligence that will help the team understand the adversary's likely next steps and prioritize containment efforts. Which type of threat intelligence should the analyst prioritize?

Question 52hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is tasked with creating a risk assessment for a new ransomware variant that has been observed targeting the organization's industry. The analyst has technical indicators, TTPs, and strategic reports from an ISAC. To effectively communicate the risk to the executive team, which component should the analyst emphasize?

Question 1mediummultiple choice

Read the full Ansible explanation →

In Palo Alto Networks Cortex XSOAR, you are building a playbook to automate the qualification of incoming phishing alerts. Which integration command is used to calculate a 'reputation score' based on data from a connected threat intelligence platform (TIP)?

Question 2mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

When using IBM QRadar Incident Forensics, you identify an ongoing data exfiltration attempt. To integrate external TI feeds for automated IOC blocking, which configuration tab in the QRadar Log Activity app allows for immediate watchlist creation?

Question 3hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are managing a CrowdStrike Falcon Insight deployment. To proactively hunt for an adversary identified in a recent TI report, which search language should you use to query the Event Search interface for a specific file hash?

Question 4hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are setting up a TAXII server for threat intelligence sharing. Which component of the STIX 2.1 specification defines the relationship between a threat actor and the infrastructure they use?

Question 5mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are configuring a Splunk Enterprise Security (ES) Threat Intelligence Framework to ingest STIX data. Which specific lookup table must be populated to enable the 'Threat Activity' dashboard to correlate external indicators with internal notable events?

Question 6easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst needs to verify if an IP address flagged by a TI feed is a known Tor exit node. Which category of threat intelligence is this information considered?

Question 7mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

During an IR engagement, you observe a beaconing pattern to a suspicious domain. Which tool feature in Wireshark would you use to export domain names for further analysis against your TI feed?

Question 8hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are using ThreatConnect to prioritize indicators. Which scoring metric is automatically calculated based on the confidence level of the source and the age of the indicator?

Question 9mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which TWO types of intelligence are most essential for an Incident Response team during an active attack investigation?

Question 10hardmulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which TWO protocols are most commonly used for the automated exchange of threat intelligence between different organizations or platforms?

Question 11mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst receives a high-confidence indicator of compromise (IOC) from a trusted ISAC: a SHA-256 hash of a malicious binary. The organization's endpoint detection and response (EDR) solution supports automated response actions. The analyst wants to immediately block this hash across all endpoints. Which action should the analyst take first according to threat intelligence best practices?

Question 12hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is preparing a report for the SOC manager after a ransomware incident. The analyst has external feeds indicating the ransomware group's TTPs, internal logs showing initial access via a phishing attachment, and a risk assessment showing the affected business unit has a low tolerance for downtime. Which combination of intelligence types should the analyst prioritize to directly support the SOC's future detection and response efforts?

Question 13mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is preparing to share indicators of compromise (IOCs) with a partner organization. To ensure the sharing is effective and secure, which two considerations are most important according to threat intelligence sharing best practices? (Choose two.)

Question 14mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is evaluating a new external feed for integration into the SOC's detection stack. The feed provides indicators of compromise (IOCs) with varying confidence levels and includes some outdated IP addresses. The analyst must decide which criteria are most important to assess before operationalizing the feed. (Choose two.)

Question 15mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst is using threat intelligence to enhance the incident response process. The analyst wants to integrate intelligence into the IR lifecycle to improve detection, containment, and recovery. Which two actions best leverage threat intelligence during the containment phase of an incident? (Choose two.)

Question 16easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?

Question 17mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?

Question 18mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

In Microsoft Sentinel, you are tasked with creating a hunting query to detect 'Living off the Land' techniques. Which KQL operator allows you to join TI indicator data with device logs?

Question 19easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Your management team requires a high-level summary of the threat landscape to inform budget allocation. Which type of threat intelligence report should you provide?

Question 20mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are reviewing a threat intelligence report regarding a new malware variant. Which section of the report is most critical for your incident responders to identify local presence of the infection?

Question 21easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which of the following is a primary 'push' source for threat intelligence in an enterprise SOC?

Question 22hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are configuring a SIEM to ingest STIX/TAXII feeds. What is the benefit of setting an 'Expiration' time on ingested indicators?

Question 23mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are configuring a firewall to block domains identified by your TI platform. What is the primary risk of using 'automated blocking' without human verification?

Question 24mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which THREE factors should be considered when assessing the 'relevance' of a threat intelligence feed for your organization?

Question 25hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

In a threat intelligence lifecycle, what is the specific role of the 'Dissemination' phase in relation to the IR team?

Question 26mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which THREE types of information should be collected during the 'Processing' phase of the intelligence cycle to ensure data quality?

Question 27hardmulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which TWO components are mandatory for a valid STIX 2.1 'Indicator' object to function within an automated ingestion system?

Question 28mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which THREE actions should a SOC team perform when a high-confidence indicator is received via a threat intelligence feed?

Question 29hardmulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which TWO aspects of a threat intelligence report are most useful for long-term strategic risk management decisions?

Question 30easymulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which THREE of the following are considered 'Internal' sources of threat intelligence for a SOC?

Question 31hardmulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst is building a risk-based alert prioritization model in their SIEM. They want to enrich incoming alerts with threat intelligence that reflects the organization's specific business context. Which TWO data sources should be integrated into the risk scoring to achieve this? (Choose two.)

Question 32mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is supporting an incident response team during an active ransomware outbreak. The IR team needs to know if the ransomware strain has been observed using a specific lateral movement technique. Which action should the analyst take to provide the most actionable intelligence?

Question 33easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC manager is defining the intelligence requirements for the incident response team. The team wants to receive threat intelligence that helps them quickly determine the scope of a potential breach. Which type of intelligence best supports this need?

Question 34mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

During an active ransomware incident, your SOC manager asks you to quickly determine whether the malware family has known lateral movement capabilities against Windows environments. Which threat intelligence product best supports this immediate need?

Question 35hardmulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are building a threat intelligence program for a SOC and must define processes for the 'Direction' phase of the intelligence lifecycle. Which two activities belong to this phase? (Choose two.)

Question 36mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Your SOC has just onboarded a new premium threat intelligence feed that delivers atomic indicators with a confidence score of 85. During the first week, analysts notice that 40% of the IP addresses in the feed are sinkholed by the vendor but still resolve to live infrastructure in your environment. You need to configure your SIEM to ingest these indicators while minimizing false positives from sinkholed addresses. What should you do first?

Question 37easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst receives a threat intelligence report indicating that a new phishing campaign is targeting your industry with a specific malicious domain. The analyst wants to quickly check if any internal hosts have communicated with that domain. Which action should the analyst take first?

Question 38hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is integrating a new external feed into the organization's SIEM. The feed provides indicators with varying confidence levels. The analyst must ensure that only high-confidence indicators trigger automated alerts to reduce false positives. Which component of the intelligence lifecycle is most directly involved in this filtering process?

Question 39mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are the CTI lead at a hospital network. Your SOC receives a vendor report stating that a ransomware group is actively targeting healthcare providers in your region with a new encryptor. Your CISO asks what the FIRST action should be to convert this intelligence into operational value for the SOC. What do you do?

Question 40hardmultiple choice

Study the full IPv6 explanation →

You are a threat intelligence analyst supporting a SOC. The SOC uses a SIEM that ingests indicators from multiple feeds. You notice that a high-priority indicator from a trusted feed is not generating alerts. After investigation, you find the indicator is an IPv6 address, but the SIEM's ingestion parser only supports IPv4. What is the most appropriate action to improve the intelligence program?

Question 41easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A junior analyst is tasked with creating a report for the SOC manager on the current threat landscape. The analyst has collected data from various sources, including open-source reports, internal incident tickets, and premium feeds. Which phase of the threat intelligence lifecycle should the analyst focus on to ensure the report is tailored to the organization's specific needs?

Question 42hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

During an active incident, your IR team needs to know whether a specific IP address is a known C2 node. Your TI platform returns a confidence score of 95 with a first-seen date of 14 months ago. What is the most appropriate way to use this intelligence in the IR decision-making process?

Question 43mediummultiple choice

Read the full VPN explanation →

A risk manager asks you to provide threat intelligence that helps prioritize patching efforts for a newly disclosed vulnerability in your internet-facing VPN appliance. Which type of intelligence is most relevant for this request?

Question 44easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Your organization's SOC is drowning in alerts, and the CISO wants to reduce noise using threat intelligence. Which approach best applies TI to prioritize alerts during triage?

Question 45mediummulti select

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Your SOC is building a threat intelligence program and the CISO asks which outputs should be delivered to the risk management team to support enterprise risk decisions. (Choose two.)

Question 46mediummultiple choice

Read the full DNS explanation →

A SOC analyst receives a threat intelligence report indicating that a specific APT group is targeting the organization's industry with a new malware family that uses DNS tunneling for command and control. The analyst wants to create a detection rule in the SIEM to identify this activity. Which data source and detection logic would be most effective?

Question 47hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Your organization uses a commercial TI platform that ingests multiple feeds. During an incident review, you notice that one feed consistently produces indicators that later turn out to be benign cloud provider IP ranges. What is the most appropriate corrective action to improve the intelligence program?

Question 48easymultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is asked to support the incident response team during an active investigation of a suspected compromise. The IR team needs to know whether the observed IP address 203.0.113.45 is associated with any known threat actor. Which action should the analyst take first?

Question 49mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst is triaging a suspected intrusion and receives a threat intelligence report that contains a list of adversary tactics, techniques, and procedures (TTPs) from a known APT group. The analyst wants to map these TTPs to the MITRE ATT&CK framework to identify gaps in detection coverage. Which type of threat intelligence is the analyst primarily using?

Question 50hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is integrating a new feed into the SOC's SIEM. The feed provides indicators with a confidence score of 75. The analyst notices that some indicators are six months old and have not been observed recently. According to best practices for threat intelligence in SOC operations, what should the analyst do first to ensure effective alerting?

Question 51mediummultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC manager is reviewing the incident response process and wants to ensure that threat intelligence is effectively used during an active incident. The manager asks the analyst to provide intelligence that will help the team understand the adversary's likely next steps and prioritize containment efforts. Which type of threat intelligence should the analyst prioritize?

Question 52hardmultiple choice

Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is tasked with creating a risk assessment for a new ransomware variant that has been observed targeting the organization's industry. The analyst has technical indicators, TTPs, and strategic reports from an ISAC. To effectively communicate the risk to the executive team, which component should the analyst emphasize?