Augmenting Vulnerability Management with Threat Intelligence TIE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst at a mid-sized company is triaging a list of 200 vulnerabilities from a recent scan. The team has limited patching capacity and wants to address the most urgent risks first. The analyst pulls threat intelligence feeds that show active exploitation of a specific remote code execution vulnerability in an internet-facing application, while several higher-CVSS vulnerabilities have no known exploits and are not targeted by any observed threat actors. Which approach best aligns with threat-informed prioritization?

   • ARemediate vulnerabilities in the order they appear in the scanner report to avoid missing any critical items.
   • BPrioritize the actively exploited remote code execution vulnerability first, then address other vulnerabilities based on a combination of CVSS score, exploit availability, and exposure.
   • CPatch all vulnerabilities with a CVSS score above 9.0 first, regardless of threat context.
   • DWait for the next scheduled patch cycle and apply all updates at once, regardless of active exploitation.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company wants to integrate threat intelligence into its vulnerability management process but has limited budget and staff. They currently use an open-source vulnerability scanner and a free threat intelligence feed. Which integration point would provide the most immediate value with minimal additional cost?

   • AHire additional analysts to manually correlate the threat feed with scan results.
   • BReplace the open-source scanner with a commercial scanner that includes built-in threat intelligence.
   • CAutomatically import the threat intelligence feed into the vulnerability scanner to enrich scan results with exploit and threat-actor context.
   • DPurchase a commercial threat intelligence platform and integrate it with all existing security tools.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company uses a vulnerability scanner that generates a weekly report. The security team manually reviews the report and cross-references it with public exploit databases and threat feeds. They want to reduce the time spent on this manual correlation and ensure that vulnerabilities with active exploit activity are flagged immediately. Which integration point would most directly address this need?

   • ASubscribe to a threat intelligence newsletter and wait for weekly summaries to identify relevant vulnerabilities.
   • BIncrease the frequency of vulnerability scans to daily, but keep the manual review process unchanged.
   • CIntegrate threat intelligence feeds directly into the vulnerability scanner so that scan results are automatically enriched with exploit and threat-actor context.
   • DExport the vulnerability report to a spreadsheet and share it with the threat intelligence team for manual review.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a valid integration point for threat intelligence within the vulnerability management process?

   • AUsing exploit intelligence to enrich vulnerability scan results
   • BUsing threat intelligence to eliminate the need for vulnerability assessments
   • CUsing threat intelligence to automatically patch all vulnerabilities
   • DReplacing vulnerability scanners with threat intelligence feeds
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which metric would best measure the effectiveness of using threat intelligence in vulnerability prioritization?

   • AAverage CVSS score of all vulnerabilities
   • BTotal number of vulnerabilities discovered in the environment
   • CPercentage of exploited vulnerabilities that were prioritized before exploitation occurred
   • DNumber of threat intelligence feeds subscribed to
   Reveal Solution Discussion Select an answer first