Examkin

Soru

Zorluk: OrtaThreat Intelligence Sources and Research

A security analyst is designing an automated threat intelligence integration strategy for an enterprise network. The strategy requires feeds that provide real-time, machine-readable indicators of compromise (IoCs) formatted for direct ingestion into edge firewalls and SIEM systems, as well as trusted sector-specific collaborative threat sharing. Which of the following intelligence sources or delivery mechanisms should the analyst select to meet these specific operational requirements? (Select TWO.)

  1. Commercial threat intelligence feeds delivered via Trusted Automated eXchange of Intelligence Information (TAXII)Cevap
  2. B
    Searching the National Vulnerability Database (NVD) for Common Vulnerabilities and Exposures (CVE) entries
  3. Information Sharing and Analysis Center (ISAC) feeds utilizing Automated Indicator Sharing (AIS)Cevap
  4. D
    Scraping public security blogs and social media platforms for open-source intelligence (OSINT)
  5. E
    Manually monitoring dark web forums for leaked enterprise administrative credentials

Cevap

The correct selections are Commercial threat intelligence feeds delivered via TAXII and Information Sharing and Analysis Center (ISAC) feeds utilizing Automated Indicator Sharing (AIS).
Commercial threat intelligence feeds delivered via TAXII and ISAC feeds utilizing AIS both provide structured, machine-readable threat data (such as STIX) that can be automatically ingested in real time by SIEMs and firewalls. Furthermore, ISACs fulfill the requirement for sector-specific peer intelligence sharing.

Adım Adım Çözüm

1
Analyze requirement 1: Automated real-time machine-readable indicators of compromise (IoCs) for security devices.
Identify TAXII as the standardized transport protocol used to deliver structured threat intelligence (STIX) directly to SIEMs and firewalls.
TAXII automates the exchange of cyber threat information in machine-readable formats without human intervention.
2
Analyze requirement 2: Trusted sector-specific collaborative threat sharing among industry peers.
Identify ISACs and AIS as the organizational and technical framework built for industry-specific threat sharing.
ISACs facilitate sector-focused information sharing, while AIS provides the automated mechanism to distribute indicators among members.
3
Evaluate remaining options against the criteria.
Eliminate vulnerability databases (NVD), unstructured OSINT scraping, and manual dark web monitoring.
None of these options provide structured, low-latency, machine-readable IoC feeds designed for direct automated perimeter control updating.

Anahtar Kavram

Threat Intelligence Sources and Automated Sharing Protocols
Bu soruyu puanla

Konular

Threat Intelligence Sources and Research

Bu konudan daha fazla soru