Examkin

Question

Difficulty: MediumThreat Intelligence Sources and Research

During an active ransomware campaign impacting healthcare infrastructure, a security analyst at a regional hospital network needs to obtain verified indicators of compromise (IOCs) and threat actor tactics specifically targeting medical equipment. The analyst requires a trust-based, sector-focused intelligence pool that facilitates sanitized peer-to-peer telemetry exchange without exposing internal infrastructure details to commercial third parties. Which intelligence resource is best suited for this operational requirement?

  1. Sector-specific Information Sharing and Analysis Center feedsAnswer
  2. B
    Internal network honeypots and deception traps
  3. C
    National Vulnerability Database Common Vulnerability Scoring System records
  4. D
    Automated security orchestration and response containment playbooks

Answer

Sector-specific Information Sharing and Analysis Center feeds
Information Sharing and Analysis Centers (ISACs) are non-profit organizations that facilitate peer-to-peer threat intelligence sharing within specific critical infrastructure sectors. Joining a sector-specific ISAC allows organizations to receive vetted threat indicators and adversary tactics tailored to their industry while sharing anonymized telemetry within a trusted community.

Step-by-Step Solution

1
Analyze the operational requirements stated in the scenario
Identified the need for industry-tailored threat intelligence, peer-to-peer telemetry exchange, and trust-based indicator sharing for critical infrastructure.
The organization needs threat indicators specific to healthcare technologies without relying solely on generic or commercial feeds.
2
Evaluate the capabilities of information-sharing intelligence resources
Recognized that Information Sharing and Analysis Centers (ISACs) connect industry peers to exchange domain-specific threat indicators and mitigation strategies securely.
ISACs are built around trust communities tailored to vital sectors such as healthcare, financial services, and aviation.
3
Differentiate ISAC resources from local controls, vulnerability databases, and automation frameworks
Confirmed that internal honeypots, vulnerability repositories, and SOAR execution mechanisms do not replace peer-driven threat intelligence sharing.
Only an ISAC directly satisfies the requirement for trust-based, sector-specific collaborative threat research.

Key Concept

Information Sharing and Analysis Centers (ISACs)
Rate this question

Topics

Threat Intelligence Sources and Research

More questions from this topic