200-201 Question 22
Select 3A security analyst at your organization receives a threat intelligence report indicating a new malware campaign targeting financial institutions. The report includes Indicators of Compromise (IoCs) such as IP addresses, domain names, and file hashes. Which of the following actions should the analyst take to leverage the threat intelligence effectively?
- A
Update the organization's firewall and intrusion detection system (IDS) with the provided IoCs.
- B
Share the threat intelligence report with external vendors without any modifications.
- C
Cross-reference the IoCs with the organization's current network activity to identify potential compromises.
- D
Ignore the report if no immediate threats are detected in the organization.
- E
Submit the IoCs to an internal threat intelligence platform for further correlation and analysis.
Show answer and explanation
Correct answers: A, C, E
Explanation
Effective use of threat intelligence involves updating security controls with IoCs, analyzing network activity for potential compromises, and leveraging internal platforms for advanced correlation. These actions enhance the organization's ability to detect and mitigate threats proactively, minimizing potential risks.
- A. Correct.
Updating the organization's firewall and IDS with the provided IoCs helps block malicious traffic and detect suspicious activity, making this a critical step.
- B. Incorrect.
Sharing the report with external vendors without any modifications could violate confidentiality agreements or expose sensitive details, making this an inappropriate action.
- C. Correct.
Cross-referencing the IoCs with current network activity can help identify if the organization has already been targeted, which is a necessary step.
- D. Incorrect.
Ignoring the report is not a good practice, as proactive measures are essential even if immediate threats are not identified.
- E. Correct.
Submitting the IoCs to an internal threat intelligence platform allows for further correlation, improving the organization's ability to detect and respond to threats.