Integrating Threat Intelligence in Cyber Operations TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company wants to automatically block outbound connections to known malicious IP addresses at the firewall. The threat intelligence team maintains a list of indicators updated hourly. Which integration approach is most effective for this requirement?

   • AConfigure the firewall to query the threat intelligence platform only when a user reports a suspicious website.
   • BExport the indicator list to a CSV file and import it into the firewall once a week.
   • CManually review the indicator list each hour and update the firewall rules by hand.
   • DUse an API-based integration between the threat intelligence platform and the firewall to push updated indicators automatically.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is planning to integrate threat intelligence into its security operations, but it has a mix of legacy and modern systems. The team wants to ensure that intelligence is used consistently across all systems. What is the best approach?

   • AUse a threat intelligence platform (TIP) as a central hub to distribute intelligence to all systems, including legacy ones via adapters
   • BReplace all legacy systems with modern ones that support direct integration
   • CIntegrate intelligence only into the most critical systems and ignore the rest
   • DManually copy intelligence from the feed to each system
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC wants to implement a new threat intelligence feed, but the existing SIEM has limited storage and processing capacity. The team must decide how to integrate the feed without overwhelming the system. What is the best approach?

   • AUse the feed only for weekly reports and not for real-time detection
   • BFilter the feed to include only indicators relevant to the organization's environment before ingestion
   • CStore the feed in a separate database and query it manually when needed
   • DIngest all indicators from the feed into the SIEM and increase storage capacity
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC analyst receives an alert for a known malicious IP address that is attempting to connect to an internal server. The alert is part of a high volume of similar alerts. The analyst needs to quickly determine if this specific alert requires immediate action. Which approach best integrates threat intelligence into the triage process?

   • ABlock the IP at the firewall and close the alert without further analysis
   • BUse the threat intelligence platform to enrich the alert with context such as related campaigns, indicators, and suggested response actions
   • CAutomatically escalate all alerts involving known malicious IPs to incident response
   • DIgnore the alert because the IP is already known and therefore not a real threat
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   During incident response, how does threat intelligence typically support the containment phase?

   • ABy identifying indicators of compromise that help isolate affected systems
   • BBy replacing the incident response team
   • CBy providing legal advice for prosecution
   • DBy automatically deleting all affected files
   Reveal Solution Discussion Select an answer first