CCNA Threat Intelligence IN SOC IR And Risk Management Questions

Planning and Direction is the phase where intelligence requirements are defined based on the organization's needs, such as the SOC manager's request for a tailored threat landscape report. This phase ensures that collection and analysis efforts are aligned with specific objectives, preventing irrelevant or excessive data from being included.

Indicators of Compromise list concrete artefacts such as file hashes, domains, IP addresses and registry keys. Incident responders use these to search local systems and logs, determining whether the malware variant is actually present, which is the report section that enables local detection.

Relevance depends on whether the feed addresses threats your sector actually faces. An industry vertical focus ensures reported actors, tactics and vulnerabilities map to your operating environment, so analysts are not flooded with intelligence about unrelated sectors.

MITRE ATT&CK catalogues adversary tactics and techniques observed in real incidents, letting you map ransomware behaviour to specific internal controls and expose coverage gaps. Most modern threat-intelligence platforms natively support ATT&CK, satisfying the stem's requirement for a widely supported framework for technique-to-control mapping during impact analysis.

Expiration times automatically retire indicators once their validity window lapses, so the SIEM stops matching against threat data that no longer reflects current adversary infrastructure. This directly curbs false positives caused by stale indicators, satisfying the requirement to keep detection logic aligned with fresh, actionable intelligence.

Using the vendor-provided 'sinkholed' attribute lets you keep the indicators for historical hunting while preventing them from triggering high-severity alerts, because traffic to a sinkhole is not evidence of live adversary control. This approach preserves intelligence context, reduces false positives, and allows analysts to distinguish between active C2 and research-controlled infrastructure.

Automated blocking acts on indicators without analyst context, so legitimate domains sharing infrastructure or reputation signals with threats get blocked, disrupting business services. Human verification confirms malicious intent before enforcement, preventing false positives from degrading operations.

Asset criticality links technical alerts to business impact. When an alert fires on a host that supports a revenue-generating service, the risk score should increase. Without this mapping, all hosts appear equal, and prioritization cannot reflect business context. This is a core input for risk-based alerting in a SOC.

The disciplined response is to tune the feed with filtering and scoring while feeding back the observed false positives to the vendor. This preserves the feed's genuine value, reduces noise at ingestion, and applies pressure on the source to improve quality. It also documents the issue for future source evaluation, which is a core part of running a mature intelligence program.

Analysis is where raw intelligence is evaluated for relevance, reliability, and confidence. In this scenario, the analyst applies confidence thresholds to determine which indicators should trigger alerts. This step involves contextualizing the data and making judgments about its trustworthiness, directly influencing automated alerting rules.

Strategic threat intelligence delivers high-level, long-term analysis of the threat landscape, risks and adversary trends. It is written for executives and management to guide budget allocation and risk decisions, unlike tactical or operational reports focused on indicators and TTPs.

The root cause is the SIEM's inability to parse and match IPv6 indicators. Updating the platform to support IPv6 ensures that all indicators, regardless of IP version, are ingested and alerted on. This is a sustainable fix that preserves the value of the trusted feed and aligns with the growing adoption of IPv6 in networks and threats.

Hunting the indicator across endpoints searches for existing compromise that perimeter controls cannot see, such as internal lateral movement or resident malware. This addresses the stem's high-confidence feed by proactively scoping whether the threat already evaded preventive controls.

The report describes adversary behavior (TTPs), so the correct first step is to translate it into ATT&CK techniques and assess current detection and control coverage. This turns vague vendor reporting into a measurable gap analysis the SOC can act on, and it prioritizes engineering work where the hospital is actually exposed rather than chasing generic IOCs.

Long-term trend forecasting draws on historical reporting spanning months or years, revealing shifts in adversary tactics, targeting and capability. That horizon supports strategic investment and policy decisions, unlike tactical indicators such as IP addresses or hashes, which expire quickly and inform only immediate detection.

DNS tunneling encodes data in DNS queries and responses, often using long subdomains and high query volumes to a single domain. Analyzing DNS query logs for these patterns directly detects the C2 technique described. This data source is readily available in most enterprises and provides the necessary visibility into the DNS layer where the tunneling occurs.

Dissemination delivers finished intelligence to the IR team in a format and timeframe they can act on, satisfying the stem's requirement for usable, timely delivery. It is the phase that translates analysis into consumable reports, briefings or machine-readable feeds, ensuring responders receive actionable indicators before threats materialise.

Enrichment with context adds surrounding metadata and situational detail to raw collected data, improving its interpretability and analytical value during Processing. This contextual layer helps analysts assess relevance and reliability, supporting the data-quality objectives of the intelligence cycle's Processing phase.

A commercial threat feed is a push source: the vendor proactively delivers curated indicators and reports to the subscriber without the SOC requesting them. This contrasts with pull sources such as internal log queries or open-source lookups, satisfying the requirement for externally initiated intelligence delivery.

Searching historical DNS and proxy logs is the fastest way to identify internal hosts that may have resolved or connected to the malicious domain. This directly answers whether the organization has been exposed and guides immediate containment. It uses existing telemetry and does not require deploying new tools, making it the appropriate first step.

A threat intelligence platform aggregates reports and indicators about ransomware families, including their tactics, techniques, and procedures. Searching for the family reveals whether the lateral movement technique is part of its known behavior, giving the IR team actionable guidance to hunt for that technique. This is the most direct way to answer the question.

Executives are primarily concerned with business impact, financial loss, and strategic risk. Emphasizing the potential impact and likelihood of the ransomware affecting the organization translates technical intelligence into business terms, enabling informed decision-making. This approach aligns with the goals of strategic threat intelligence and effective risk communication.

The pattern property holds the actual detection logic — the STIX patterning expression describing observable characteristics. Without it, an Indicator object cannot express what to detect, so automated ingestion systems have nothing to match against telemetry.

Technical intelligence from malware analysis describes specific behaviors, including lateral movement techniques such as SMB exploitation or credential dumping, mapped to MITRE ATT&CK. This directly answers whether the family can move laterally on Windows and informs immediate containment and hunting actions during the active incident.

Mapping control gaps to relevant ATT&CK techniques shows risk management exactly where the organization is exposed to the threats that matter most. This connects technical detection coverage to risk treatment decisions, making it clear which investments would reduce the most consequential exposure and providing an auditable, defensible basis for remediation prioritization.

The join operator correlates the indicator-of-compromise table with device telemetry on a shared key such as IP address or file hash, satisfying the requirement to fuse threat intelligence with log data for Living off the Land detection.

Tactical threat intelligence provides specific details about adversary tactics, techniques, and procedures (TTPs), often mapped to frameworks like MITRE ATT&CK. It is designed for SOC analysts and detection engineers to identify and close gaps in monitoring. In this scenario, the analyst is using TTPs to map to ATT&CK, which is a core function of tactical intelligence.

Technical intelligence includes IP addresses, domains, file hashes, and behavioral TTPs that can be used to search for evidence of compromise across the environment. This directly supports scoping a breach by allowing the IR team to query logs and endpoints for known malicious artifacts. It is the most actionable type for immediate response.

Combining TI enrichment with asset criticality gives analysts a risk-based queue. An alert involving a known malicious C2 IP on a domain controller outranks the same alert on an isolated test machine. This approach reduces noise by ordering work rather than deleting it, and it aligns SOC effort with business impact, which is exactly what a CISO facing alert fatigue needs.

Enriching indicators with internal telemetry and historical context helps determine whether they are still relevant to the organization's environment. This step filters out stale or false positives before they trigger alerts. By correlating with internal data, the analyst can prioritize indicators that pose a real threat, aligning with best practices for effective SOC operations.

The internal threat intelligence platform aggregates curated feeds and historical context, making it the fastest way to check for associations with known threat actors. It also allows the analyst to see if the IP has been previously observed in the organization's environment. This supports the IR team with actionable context without delay.

Operational intelligence focuses on the adversary's campaign, including their infrastructure, tools, and planned operations. It helps incident responders anticipate next steps and prioritize containment. In this scenario, the SOC manager needs intelligence to guide immediate response, making operational intelligence the most relevant because it bridges the gap between strategic goals and tactical actions.

The correct approach is to validate the indicator against live telemetry and fresher enrichment sources. Confidence tells you how sure the source was, but age affects whether the indicator is still relevant. Correlating with current logs lets the IR team confirm or refute the connection and avoid disruptive containment based on stale data, which is essential during an active investigation.

Feedback from stakeholders is used to refine PIRs and adjust the direction of the intelligence program. This iterative process is part of Direction because it redefines what the organization needs from its intelligence efforts. It ensures the program remains aligned with changing business risks and operational needs, making it a valid Direction activity.

Operational intelligence provides timely information on active campaigns, including whether a vulnerability is being exploited, by whom, and with what impact. This directly supports prioritization by indicating real-world threat activity. For a newly disclosed VPN vulnerability, knowing if it is exploited in the wild is critical for deciding how quickly to patch relative to other tasks.

Planning and Direction sets the intelligence requirements and scope, defining which threat actors, such as specific APT groups, are relevant to the organisation. This stage directs subsequent collection and analysis, so identifying targeting APTs occurs here rather than during collection or dissemination.

EDR platform alerts qualify as internal threat intelligence because they originate from telemetry generated within the organisation's own monitored endpoints. This satisfies the stem's "Internal" constraint, distinguishing them from external feeds such as vendor reports or OSINT. Alerts capture actual adversary behaviour against your estate, providing organisation-specific indicators unavailable from outside sources.