Building Public and Private Sharing Channels TIE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A threat intelligence sharing community is experiencing a high volume of low-quality or duplicate indicators, which is overwhelming its members. The community wants to improve data quality without discouraging participation. What is the most effective approach?

   • AAutomatically accept all indicators without review
   • BBan members who submit low-quality indicators
   • CRestrict sharing to only a few trusted members
   • DImplement a quality scoring system and provide feedback to contributors
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization is joining a private threat intel sharing community. The community requires members to submit indicators in a specific format (e.g., STIX/TAXII). The organization's internal tools produce indicators in a different format. What should the organization do to participate effectively?

   • ARefuse to join the community because of the format mismatch
   • BShare indicators only through informal email to community members
   • CSubmit indicators in the internal format and ask the community to adapt
   • DUse a converter or middleware to transform indicators into the required format before submission
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services company wants to share threat intelligence with a select group of peer institutions that have signed a mutual non-disclosure agreement. What type of sharing channel should the company use?

   • AAn internal ticketing system
   • BA public OSINT feed
   • CA private, invitation-only community or feed
   • DA social media post on a public forum
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   A security operations center (SOC) needs to receive real-time threat intel feeds. They have a high-volume SIEM that can ingest many indicators, but they are concerned about alert fatigue from false positives. Which channel selection would best balance volume and quality?

   • ASubscribe to a curated private feed from a trusted vendor with a lower volume but higher confidence indicators
   • BSubscribe to all available public feeds to maximize coverage
   • CSubscribe to a public OSINT feed with a high volume of indicators
   • DAvoid all external feeds and rely only on internal detection
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security vendor has developed a new detection rule for a sophisticated attack campaign. The rule is highly effective but contains proprietary logic that would lose its value if publicly disclosed. The vendor wants to help customers and the broader community without revealing the rule. What is the best sharing strategy?

   • AShare only the rule's name and a vague description publicly
   • BPublish the rule publicly to maximize community benefit
   • CShare the rule privately with customers under a non-disclosure agreement
   • DKeep the rule entirely internal and do not share it
   Reveal Solution Discussion Select an answer first