Importance of Information Sharing Initiatives TIE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A large retail chain is a member of a retail ISAC and receives a TLP:AMBER alert about a new point-of-sale (POS) malware campaign. The alert includes YARA rules and network indicators. The chain's SOC wants to deploy the YARA rules to endpoint detection tools and block the network indicators at the firewall. However, the SOC is concerned that the YARA rules may cause false positives on legitimate POS software. The CISO wants to act quickly but also avoid disrupting business operations. What is the best course of action?

   • AIgnore the YARA rules and only use the network indicators because they are easier to deploy.
   • BWait for the ISAC to provide additional validation before taking any action.
   • CDeploy the YARA rules in monitoring mode first, while blocking the network indicators immediately.
   • DBlock the network indicators and deploy the YARA rules in enforcement mode immediately to maximize protection.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During an active ransomware incident, a manufacturing company receives a TLP:RED alert from its sector ISAC containing the attacker's C2 infrastructure and encryption indicators. How should the company's incident response team use this information to improve its response?

   • AWait for the CERT to provide a full analysis before taking any action.
   • BImmediately block the C2 domains and IPs in the firewall and search for the encryption indicators across endpoints.
   • CPublish the indicators on the company's public website to warn other organizations.
   • DForward the TLP:RED alert to all business partners to warn them of the threat.
   Reveal Solution Discussion Select an answer first
4. 3application · easy

   A security operations center (SOC) analyst receives a STIX bundle from a partner organization. The analyst needs to extract the IP addresses and file hashes to create detection rules. What is the primary advantage of receiving this intelligence in STIX format?

   • AThe format guarantees that all indicators are accurate and false positives are eliminated.
   • BThe format is human-readable and requires no additional tools to understand.
   • CThe format automatically deploys detection rules to all connected SIEMs.
   • DThe structured format allows automated parsing and integration into security tools.
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   A new cybersecurity startup wants to contribute to the threat intelligence community but has limited resources and no existing relationships. The startup's goal is to both receive intelligence and build a reputation as a responsible sharer. Which approach is most aligned with this goal?

   • APublish all discovered vulnerabilities on a public blog to gain visibility quickly.
   • BJoin a local or sector-specific ISAC and start by sharing low-sensitivity indicators while actively participating in working groups.
   • CCreate a private sharing group with other startups to avoid established organizations.
   • DWait until the startup has enough data to share a large, comprehensive report.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of the Traffic Light Protocol (TLP) in information sharing?

   • ATo define the color of the user interface in threat intelligence platforms
   • BTo encrypt all shared threat intelligence data
   • CTo automatically classify malware samples based on their behavior
   • DTo indicate the level of sensitivity and the allowed distribution of shared information
   Reveal Solution Discussion Select an answer first