Courseiva

312-85 · topic practice

Threat Intelligence IN SOC IR And Risk Management practice questions

This domain covers how threat intelligence feeds SOC detection, incident response, and risk decisions in Microsoft-centric environments. Expect scenario questions on Sentinel KQL hunting queries, TI-driven alert triage and prioritization, indicator enrichment during live incidents, and judging indicator confidence, age, and relevance before acting on it.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member
20 questionsDomain: Threat Intelligence IN SOC IR And Risk Management
Practice 10 questionsBrowse domain →

What the exam tests

What to know about Threat Intelligence IN SOC IR And Risk Management

Be able to write Sentinel KQL that joins TI indicators to device logs, and to apply confidence, first-seen age, and incident context when prioritizing alerts or answering IR questions about a specific IP. The key skill is judging indicator actionability, not just matching it.

Writing Sentinel KQL joins that correlate threat intelligence indicators with device and sign-in logs

Using TI to prioritize and suppress alerts during SOC triage rather than blocking outright

Enriching incident response with indicator context: IP reputation, C2 association, first-seen and confidence

Applying indicator aging and confidence scores to decide whether observed infrastructure is actionable

Watch out for

Common Threat Intelligence IN SOC IR And Risk Management exam traps

  • ▸Treating every TI match as confirmed compromise instead of weighing confidence, age, and business context during triage
  • ▸Blocking or escalating on stale indicators without checking first-seen dates and current relevance to the investigation
  • ▸Joining TI tables to logs without matching indicator types and time windows, producing noisy or empty KQL results

Practice set

Threat Intelligence IN SOC IR And Risk Management questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice
Read the full Ansible explanation →

In Palo Alto Networks Cortex XSOAR, you are building a playbook to automate the qualification of incoming phishing alerts. Which integration command is used to calculate a 'reputation score' based on data from a connected threat intelligence platform (TIP)?

Question 2mediummultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

When using IBM QRadar Incident Forensics, you identify an ongoing data exfiltration attempt. To integrate external TI feeds for automated IOC blocking, which configuration tab in the QRadar Log Activity app allows for immediate watchlist creation?

Question 3hardmultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are managing a CrowdStrike Falcon Insight deployment. To proactively hunt for an adversary identified in a recent TI report, which search language should you use to query the Event Search interface for a specific file hash?

Question 4hardmultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are setting up a TAXII server for threat intelligence sharing. Which component of the STIX 2.1 specification defines the relationship between a threat actor and the infrastructure they use?

Question 5mediummultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are configuring a Splunk Enterprise Security (ES) Threat Intelligence Framework to ingest STIX data. Which specific lookup table must be populated to enable the 'Threat Activity' dashboard to correlate external indicators with internal notable events?

Question 6easymultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst needs to verify if an IP address flagged by a TI feed is a known Tor exit node. Which category of threat intelligence is this information considered?

Question 7mediummultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

During an IR engagement, you observe a beaconing pattern to a suspicious domain. Which tool feature in Wireshark would you use to export domain names for further analysis against your TI feed?

Question 8hardmultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are using ThreatConnect to prioritize indicators. Which scoring metric is automatically calculated based on the confidence level of the source and the age of the indicator?

Question 9mediummulti select
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which TWO types of intelligence are most essential for an Incident Response team during an active attack investigation?

Question 10hardmulti select
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Which TWO protocols are most commonly used for the automated exchange of threat intelligence between different organizations or platforms?

Question 11mediummultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst receives a high-confidence indicator of compromise (IOC) from a trusted ISAC: a SHA-256 hash of a malicious binary. The organization's endpoint detection and response (EDR) solution supports automated response actions. The analyst wants to immediately block this hash across all endpoints. Which action should the analyst take first according to threat intelligence best practices?

Question 12hardmultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is preparing a report for the SOC manager after a ransomware incident. The analyst has external feeds indicating the ransomware group's TTPs, internal logs showing initial access via a phishing attachment, and a risk assessment showing the affected business unit has a low tolerance for downtime. Which combination of intelligence types should the analyst prioritize to directly support the SOC's future detection and response efforts?

Question 13mediummulti select
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is preparing to share indicators of compromise (IOCs) with a partner organization. To ensure the sharing is effective and secure, which two considerations are most important according to threat intelligence sharing best practices? (Choose two.)

Question 14mediummulti select
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A threat intelligence analyst is evaluating a new external feed for integration into the SOC's detection stack. The feed provides indicators of compromise (IOCs) with varying confidence levels and includes some outdated IP addresses. The analyst must decide which criteria are most important to assess before operationalizing the feed. (Choose two.)

Question 15mediummulti select
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

A SOC analyst is using threat intelligence to enhance the incident response process. The analyst wants to integrate intelligence into the IR lifecycle to improve detection, containment, and recovery. Which two actions best leverage threat intelligence during the containment phase of an incident? (Choose two.)

Question 16easymultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

When assessing risk for a new cloud application, you must determine if your organization is a target for specific APT groups. Which TI intelligence cycle stage involves identifying these specific threat actors?

Question 17mediummultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are performing an impact analysis for a potential ransomware incident. Which framework, supported by most modern TI platforms, would you use to map the adversary's techniques to internal security controls?

Question 18mediummultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

In Microsoft Sentinel, you are tasked with creating a hunting query to detect 'Living off the Land' techniques. Which KQL operator allows you to join TI indicator data with device logs?

Question 19easymultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

Your management team requires a high-level summary of the threat landscape to inform budget allocation. Which type of threat intelligence report should you provide?

Question 20mediummultiple choice
Read the full Threat Intelligence IN SOC IR And Risk Management explanation →

You are reviewing a threat intelligence report regarding a new malware variant. Which section of the report is most critical for your incident responders to identify local presence of the infection?

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused Threat Intelligence IN SOC IR And Risk Management sessions

Start a Threat Intelligence IN SOC IR And Risk Management only practice session

Every question in these sessions is drawn from the Threat Intelligence IN SOC IR And Risk Management domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all Threat Intelligence IN SOC IR And Risk Management questions →Mixed 312-85 session

Related practice questions

Related 312-85 topic practice pages

Move into related areas when this topic feels solid.

Data Analysis practice questions

Sharpen your 312-85 knowledge of Data Analysis.

Intelligence Reporting And Dissemination practice questions

Practise 312-85 questions linked to Intelligence Reporting And Dissemination.

Data Collection And Processing practice questions

Work through 312-85 questions on Data Collection And Processing.

Introduction TO Threat Intelligence practice questions

Targeted 312-85 practice covering Introduction TO Threat Intelligence.

Cyber Threats And Attack Frameworks practice questions

Work through 312-85 questions on Cyber Threats And Attack Frameworks.

Threat Hunting And Detection practice questions

Threat Hunting And Detection practice questions for 312-85.

Threat Intelligence IN SOC IR And Risk Management practice questions

Threat Intelligence IN SOC IR And Risk Management practice questions for 312-85.

Requirements Planning Direction And Review practice questions

Work through 312-85 questions on Requirements Planning Direction And Review.

312-85 fundamentals practice questions

Practise 312-85 questions linked to 312-85 fundamentals.

312-85 scenario practice questions

Sharpen your 312-85 knowledge of 312-85 scenario.

312-85 troubleshooting practice questions

Targeted 312-85 practice covering 312-85 troubleshooting.

Frequently asked questions

What does the 312-85 exam test about Threat Intelligence IN SOC IR And Risk Management?
Be able to write Sentinel KQL that joins TI indicators to device logs, and to apply confidence, first-seen age, and incident context when prioritizing alerts or answering IR questions about a specific IP. The key skill is judging indicator actionability, not just matching it.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Threat Intelligence IN SOC IR And Risk Management questions in a focused session?
Yes — the session launcher on this page draws every question from the Threat Intelligence IN SOC IR And Risk Management domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 312-85 topics?
Use the topic links above to move to related areas, or go back to the 312-85 question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the 312-85 exam covers. They are not copied from any real exam or dump site.