Question: SOC Analyst Path - Using Threat Intelligence

Learning Paths SOC Analyst
1

The second question in the “Using Threat Intelligence” Lesson says:

If we receive an alarm from the threat intelligence product we use indicating that an IP address of our organization has been blacklisted. How should we handle the incident?

A- The reason why the IP address is blacklisted should be determined.
B- The reputation should be corrected by contacting the vendor whose IP address is blacklisted.
C- The IP address should be disabled.
D- A search should be made for the server to which the IP address points.

In the lesson itself, regarding the blacklist case, we read:

If it is a blacklist case, we should investigate the root cause and determine on what sources it has been blacklisted.

Reading the latter, I would expect that the correct answer is “A”, but it’s not . Can anyone explain why?

2

Hello @vpiserchia,

It looks like there was some confusion in the question. Apart from option C, the other approaches seem to be correct. It would be more appropriate for the question to ask, “Which of the following approaches is incorrect?”

I have informed the relevant team, and they mentioned that the question will be revised.

Thank you for your feedback!