Integrating Threat Intelligence in Cyber Operations TIE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security operations team wants to automate the containment of infected endpoints using threat intelligence. However, the team is concerned about the risk of isolating critical servers that may be falsely flagged. What is the best way to implement this automation?

   • ADo not automate containment; rely on manual isolation by analysts
   • BUse a risk-based approach: automatically isolate endpoints with low business criticality, and require manual approval for critical assets
   • CIsolate all endpoints only after confirming the threat with a second intelligence source
   • DAutomatically isolate any endpoint that matches a threat intelligence indicator
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst is triaging an alert about a suspicious file hash. The hash matches a known malware family but the file was detected on a low-value workstation. The analyst has limited time. How should the analyst use threat intelligence to decide the priority of this alert?

   • AEscalate the alert to the incident response team without any analysis.
   • BTreat all alerts with a known malicious hash as critical regardless of the asset value.
   • CPrioritize the alert based on the asset's role and the malware's capabilities, using intelligence for context.
   • DClose the alert immediately because the workstation is low-value.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC is overwhelmed by alerts from a new threat intelligence feed that includes many indicators of low relevance to the organization's industry. The team wants to reduce noise without missing critical threats. Which approach best balances these concerns?

   • AIncrease the severity of all alerts from the feed to ensure they are not missed
   • BApply a scoring model that weighs indicators based on relevance to the organization's threat profile
   • CManually review each indicator before adding it to the detection system
   • DDisable the feed and rely on internal detection rules
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization wants to automate the initial response to common threats, such as blocking a malicious IP, while still allowing human analysts to handle complex incidents. Which approach best achieves this?

   • AImplement an orchestration playbook that automatically blocks IPs from threat intelligence feeds and escalates complex cases to analysts
   • BUse threat intelligence only for reporting, not for automated actions
   • CFully automate all response actions without human intervention
   • DHave analysts manually block IPs and handle all incidents
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC receives a high volume of alerts, many of which are false positives. The team wants to use threat intelligence to reduce alert fatigue. What is the most effective way to achieve this?

   • ADisable all alerts that are not directly associated with threat intelligence
   • BUse threat intelligence to enrich alerts and apply context-based filtering rules
   • CIncrease the severity of all alerts that match threat intelligence indicators
   • DManually review each alert to determine if it is a false positive
   Reveal Solution Discussion Select an answer first