CySA+ Threat Intelligence Feeds and IOC Analysis

1. Which IOC category includes information about command-and-control server addresses?

Network-based IOCs

Host-based IOCs

Email-based IOCs

Behavioral IOCs

Submit

3. Which metric is most important when evaluating the effectiveness of a threat intelligence feed?

Detection rate balanced against false positive rate

The feed's marketing budget

The number of indicators listed

The geographic location of the feed provider

4. True or False: IOCs should only be used for reactive incident response and never for proactive threat hunting.

True

False

Submit

6. What is the primary purpose of whitelisting in IOC analysis?

To prevent false positives from legitimate applications and services

To block all network traffic

To eliminate the need for threat intelligence

To automatically delete all detected threats

7. Which of the following best describes the confidence level of an IOC?

The degree of certainty that an indicator is accurate and malicious

The number of security vendors that use the indicator

The age of the indicator in days

The cost of the threat intelligence feed

8. True or False: Threat intelligence feeds should be updated continuously to maintain effectiveness.

True

False

Submit

10. What is a key challenge when correlating IOCs across multiple threat intelligence feeds?

Different feeds may use different formats and confidence levels

IOCs are always identical across all feeds

Correlation is impossible with modern tools

Feeds never contain overlapping indicators

11. What is the primary purpose of threat intelligence feeds in a security operations center?

Provide real-time indicators of compromise to detect malicious activity

Replace all manual threat hunting activities

Eliminate the need for endpoint detection and response tools

Archive historical security logs for compliance only

12. True or False: All threat intelligence feeds should be integrated directly into production systems without validation.

True

False

13. What is the primary limitation of using only IP-based IOCs for threat detection?

IP addresses can be reassigned and shared, leading to false positives

IP addresses are never used by legitimate traffic

Firewalls cannot block IP addresses effectively

IP-based IOCs are always expired within 24 hours

14. Which threat intelligence feed source is generally considered most reliable for zero-day indicators?

Commercial threat intelligence vendors with active research teams

Anonymous public forums

Random social media posts

Discontinued security blogs

Submit

16. What is the primary benefit of consuming threat intelligence from multiple feeds?

Reduces false positives and increases detection coverage

Eliminates the need for security awareness training

Guarantees 100% protection against all threats

Removes all responsibility from security analysts

17. Which of the following is a valid indicator of compromise related to network activity?

Suspicious IP address making unusual outbound connections

Employee login time outside business hours

Software license expiration date

Network switch firmware version number

18. True or False: A single IOC can definitively prove that an organization has been compromised.

True

False

19. What does STIX stand for in the context of threat intelligence?

Structured Threat Information Expression

Standard Threat Index and Exchange

Security Threat Identification XML

Standardized Threat Intelligence XML

20. Which IOC type is most commonly used to identify malware-infected hosts?

File hash (MD5, SHA-256)

Domain name registrant information

Email sender reputation score

Historical price data of security appliances

CySA+ Threat Intelligence Feeds and IOC Analysis Quiz

1. Which IOC category includes information about command-and-control server addresses?

2.

What first name or nickname would you like us to use?

2. When an IOC is found in your environment, the appropriate immediate action is to ______ and investigate.

3. Which metric is most important when evaluating the effectiveness of a threat intelligence feed?

4. True or False: IOCs should only be used for reactive incident response and never for proactive threat hunting.

5. A domain-based IOC should be enriched with ______ data to provide context.

6. What is the primary purpose of whitelisting in IOC analysis?

7. Which of the following best describes the confidence level of an IOC?

8. True or False: Threat intelligence feeds should be updated continuously to maintain effectiveness.

9. An analyst receives a file hash IOC from a trusted threat feed. The next step should be to ______ it against known samples.

10. What is a key challenge when correlating IOCs across multiple threat intelligence feeds?

11. What is the primary purpose of threat intelligence feeds in a security operations center?

12. True or False: All threat intelligence feeds should be integrated directly into production systems without validation.

13. What is the primary limitation of using only IP-based IOCs for threat detection?

14. Which threat intelligence feed source is generally considered most reliable for zero-day indicators?

15. TAXII is primarily used for ______ threat intelligence.

16. What is the primary benefit of consuming threat intelligence from multiple feeds?

17. Which of the following is a valid indicator of compromise related to network activity?

18. True or False: A single IOC can definitively prove that an organization has been compromised.

19. What does STIX stand for in the context of threat intelligence?

20. Which IOC type is most commonly used to identify malware-infected hosts?