Integrating Threat Intelligence in Cyber Operations TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team wants to reduce the time between receiving a threat intelligence feed and updating firewall rules to block newly identified malicious IPs. Which action best achieves this goal?

   • ASubscribe to a daily email digest of new indicators and update rules weekly
   • BIncrease the number of security analysts to handle manual updates more quickly
   • CManually review the feed each morning and update firewall rules accordingly
   • DConfigure the firewall to automatically pull and apply indicators from the threat intelligence feed
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In a security operations center (SOC) workflow, how does threat intelligence primarily assist during alert triage?

   • ABy generating new alerts based on historical data
   • BBy replacing the need for security monitoring tools
   • CBy automatically resolving all alerts without human intervention
   • DBy providing context that helps analysts prioritize and validate alerts
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a cyber operations framework, at which of the following stages can threat intelligence be integrated to enhance security posture?

   • AOnly during the response phase
   • BOnly during the prevention phase
   • COnly during the detection phase
   • DPrevention, detection, and response
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team has limited resources and must decide which threats to prioritize. They have intelligence indicating that a specific threat actor is actively targeting their industry, but they also have a high volume of generic malware alerts. How should they apply intelligence-driven principles to allocate resources?

   • ATreat all alerts equally to avoid bias, allocating resources evenly across all threats.
   • BPrioritize the threat actor targeting their industry while maintaining baseline monitoring for generic malware.
   • CWait for a confirmed incident before allocating resources to any specific threat.
   • DFocus exclusively on the threat actor targeting their industry, ignoring generic malware alerts.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization has limited security resources and must prioritize responses to multiple ongoing incidents. Which approach aligns with intelligence-driven security operations?

   • AAssign equal priority to all incidents to ensure fairness
   • BFocus only on incidents that have already caused damage
   • CRespond to incidents in the order they were reported
   • DPrioritize incidents based on the threat intelligence assessment of the adversary's capability and intent
   Reveal Solution Discussion Select an answer first