Threat Intelligence IN SOC IR And Risk Management

A junior analyst is tasked with creating a report for the SOC manager on the current threat landscape. The analyst has collected data from various sources, including open-source reports, internal incident tickets, and premium feeds. Which phase of the threat intelligence lifecycle should the analyst focus on to ensure the report is tailored to the organization's specific needs?

You are reviewing a threat intelligence report regarding a new malware variant. Which section of the report is most critical for your incident responders to identify local presence of the infection?

Which THREE factors should be considered when assessing the 'relevance' of a threat intelligence feed for your organization?

You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?

You are configuring a SIEM to ingest STIX/TAXII feeds. What is the benefit of setting an 'Expiration' time on ingested indicators?

Your SOC has just onboarded a new premium threat intelligence feed that delivers atomic indicators with a confidence score of 85. During the first week, analysts notice that 40% of the IP addresses in the feed are sinkholed by the vendor but still resolve to live infrastructure in your environment. You need to configure your SIEM to ingest these indicators while minimizing false positives from sinkholed addresses. What should you do first?

You are configuring a firewall to block domains identified by your TI platform. What is the primary risk of using 'automated blocking' without human verification?

A SOC analyst is building a risk-based alert prioritization model in their SIEM. They want to enrich incoming alerts with threat intelligence that reflects the organization's specific business context. Which TWO data sources should be integrated into the risk scoring to achieve this? (Choose two.)

Your organization uses a commercial TI platform that ingests multiple feeds. During an incident review, you notice that one feed consistently produces indicators that later turn out to be benign cloud provider IP ranges. What is the most appropriate corrective action to improve the intelligence program?

A threat intelligence analyst is integrating a new external feed into the organization's SIEM. The feed provides indicators with varying confidence levels. The analyst must ensure that only high-confidence indicators trigger automated alerts to reduce false positives. Which component of the intelligence lifecycle is most directly involved in this filtering process?

Your management team requires a high-level summary of the threat landscape to inform budget allocation. Which type of threat intelligence report should you provide?

You are a threat intelligence analyst supporting a SOC. The SOC uses a SIEM that ingests indicators from multiple feeds. You notice that a high-priority indicator from a trusted feed is not generating alerts. After investigation, you find the indicator is an IPv6 address, but the SIEM's ingestion parser only supports IPv4. What is the most appropriate action to improve the intelligence program?

Which THREE actions should a SOC team perform when a high-confidence indicator is received via a threat intelligence feed?

You are the CTI lead at a hospital network. Your SOC receives a vendor report stating that a ransomware group is actively targeting healthcare providers in your region with a new encryptor. Your CISO asks what the FIRST action should be to convert this intelligence into operational value for the SOC. What do you do?

Which TWO aspects of a threat intelligence report are most useful for long-term strategic risk management decisions?

A SOC analyst receives a threat intelligence report indicating that a specific APT group is targeting the organization's industry with a new malware family that uses DNS tunneling for command and control. The analyst wants to create a detection rule in the SIEM to identify this activity. Which data source and detection logic would be most effective?

In a threat intelligence lifecycle, what is the specific role of the 'Dissemination' phase in relation to the IR team?

Which THREE types of information should be collected during the 'Processing' phase of the intelligence cycle to ensure data quality?

Which of the following is a primary 'push' source for threat intelligence in an enterprise SOC?

A SOC analyst receives a threat intelligence report indicating that a new phishing campaign is targeting your industry with a specific malicious domain. The analyst wants to quickly check if any internal hosts have communicated with that domain. Which action should the analyst take first?

A threat intelligence analyst is supporting an incident response team during an active ransomware outbreak. The IR team needs to know if the ransomware strain has been observed using a specific lateral movement technique. Which action should the analyst take to provide the most actionable intelligence?

A threat intelligence analyst is tasked with creating a risk assessment for a new ransomware variant that has been observed targeting the organization's industry. The analyst has technical indicators, TTPs, and strategic reports from an ISAC. To effectively communicate the risk to the executive team, which component should the analyst emphasize?

Which TWO components are mandatory for a valid STIX 2.1 'Indicator' object to function within an automated ingestion system?

During an active ransomware incident, your SOC manager asks you to quickly determine whether the malware family has known lateral movement capabilities against Windows environments. Which threat intelligence product best supports this immediate need?

Your SOC is building a threat intelligence program and the CISO asks which outputs should be delivered to the risk management team to support enterprise risk decisions. (Choose two.)

In Microsoft Sentinel, you are tasked with creating a hunting query to detect 'Living off the Land' techniques. Which KQL operator allows you to join TI indicator data with device logs?

A SOC analyst is triaging a suspected intrusion and receives a threat intelligence report that contains a list of adversary tactics, techniques, and procedures (TTPs) from a known APT group. The analyst wants to map these TTPs to the MITRE ATT&CK framework to identify gaps in detection coverage. Which type of threat intelligence is the analyst primarily using?

A SOC manager is defining the intelligence requirements for the incident response team. The team wants to receive threat intelligence that helps them quickly determine the scope of a potential breach. Which type of intelligence best supports this need?

Your organization's SOC is drowning in alerts, and the CISO wants to reduce noise using threat intelligence. Which approach best applies TI to prioritize alerts during triage?

A threat intelligence analyst is integrating a new feed into the SOC's SIEM. The feed provides indicators with a confidence score of 75. The analyst notices that some indicators are six months old and have not been observed recently. According to best practices for threat intelligence in SOC operations, what should the analyst do first to ensure effective alerting?

A threat intelligence analyst is asked to support the incident response team during an active investigation of a suspected compromise. The IR team needs to know whether the observed IP address 203.0.113.45 is associated with any known threat actor. Which action should the analyst take first?

A SOC manager is reviewing the incident response process and wants to ensure that threat intelligence is effectively used during an active incident. The manager asks the analyst to provide intelligence that will help the team understand the adversary's likely next steps and prioritize containment efforts. Which type of threat intelligence should the analyst prioritize?

During an active incident, your IR team needs to know whether a specific IP address is a known C2 node. Your TI platform returns a confidence score of 95 with a first-seen date of 14 months ago. What is the most appropriate way to use this intelligence in the IR decision-making process?

You are building a threat intelligence program for a SOC and must define processes for the 'Direction' phase of the intelligence lifecycle. Which two activities belong to this phase? (Choose two.)

A risk manager asks you to provide threat intelligence that helps prioritize patching efforts for a newly disclosed vulnerability in your internet-facing VPN appliance. Which type of intelligence is most relevant for this request?

When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?

Which THREE of the following are considered 'Internal' sources of threat intelligence for a SOC?