Which two enrichment steps can be performed using built-in threat intelligence commands? (Choose two)

Question

Options

• ACalculate malware family
• BRetrieve WHOIS data
• CIdentify duplicate layouts
• DExtract user roles
• EQuery URL reputation

• A
  5% (1)
• B
  95% (19)

Explanation

WHOIS retrieval (B) and URL reputation queries (E) are standard enrichment actions built into threat intelligence platforms (like Splunk SOAR, Microsoft Sentinel, or similar SIEM/SOAR tools) because they query well-established external data sources - domain registrars and reputation feeds - using native, out-of-the-box commands requiring no custom development.

Why the distractors are wrong:

• A (Calculate malware family): Malware classification requires sandbox analysis or ML-based tools, not a simple built-in TI command.
• C (Identify duplicate layouts): This is a UI/design concept with no relevance to threat intelligence enrichment.
• D (Extract user roles): This is an identity/directory operation (e.g., querying Active Directory), not a threat intelligence enrichment step.

Memory tip: Think "external threat data you can look up with a single query" - WHOIS tells you who owns a domain/IP, and URL reputation tells you how dangerous a link is. Both are passive lookups against known threat intel sources, which is exactly what built-in enrichment commands are designed for.

No community discussion yet for this question.