Integrating Threat Intelligence in Cyber Operations TIE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team wants to automate blocking of malicious IPs, but the firewall team is concerned about false positives that could disrupt business operations. What is the best way to implement automation while addressing the firewall team's concern?

   • ADo not automate any blocking; rely solely on manual updates
   • BImplement a two-tier approach: automatically block high-confidence indicators and require manual approval for lower-confidence ones
   • CBlock all IPs only after they have been observed in the organization's network
   • DAutomatically block all IPs from the threat intelligence feed without review
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is feedback from security operations important for threat intelligence?

   • AIt replaces the need for external threat intelligence sources
   • BIt provides a legal basis for prosecution
   • CIt ensures that all threats are automatically neutralized
   • DIt helps refine and update intelligence to remain relevant and accurate
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team has limited resources and must decide which threats to focus on. They have access to threat intelligence that indicates a specific threat actor is actively targeting their industry. How should the team apply intelligence-driven principles to guide their decision-making?

   • ADistribute resources equally across all known threats regardless of relevance.
   • BPrioritize threats that are both relevant to the organization's industry and have a high potential impact.
   • CWait for a confirmed incident before allocating resources to any specific threat.
   • DFocus all resources on the threat actor indicated by the intelligence, ignoring other potential threats.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An organization has a mature threat intelligence program but is struggling to justify its budget to executives. The CISO needs to demonstrate the value of intelligence in reducing risk. Which approach best demonstrates this value?

   • ACorrelate intelligence-driven actions with reduced incident response times and fewer successful breaches
   • BExplain the technical details of the intelligence platform architecture
   • CShow the number of indicators processed by the intelligence platform
   • DPresent a list of all threat actors tracked by the intelligence team
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An organization is considering whether to invest in a commercial threat intelligence feed or rely on free open-source intelligence (OSINT). The security team has limited resources and needs to make a cost-effective decision. What is the most important factor to consider?

   • AThe number of indicators provided by each feed
   • BThe relevance and quality of the intelligence to the organization's specific threat landscape
   • CThe cost of the commercial feed compared to the free feed
   • DThe reputation of the vendor providing the commercial feed
   Reveal Solution Discussion Select an answer first