Integrating Threat Intelligence in Cyber Operations TIE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC has implemented an automated threat intelligence feed that blocks IP addresses at the firewall. However, they are experiencing a high number of false positives, blocking legitimate business partners. They want to reduce false positives without losing the benefits of automation. What is the best approach?

   • AImplement a risk-scoring mechanism that considers the context of the IP address before blocking.
   • BRemove the automated blocking and require manual approval for each block.
   • CBlock all IP addresses in the feed without exception to ensure security.
   • DDisable the threat intelligence feed entirely to avoid false positives.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After a security incident, the incident response team discovers that a threat actor used a new command-and-control (C2) domain that was not in the organization's threat intelligence feed. The team wants to improve future detection. What should they do to close this gap?

   • AWait for the threat intelligence vendor to update their feed on their own schedule.
   • BIncrease the frequency of vulnerability scans to prevent similar incidents.
   • CDelete the domain from all logs to avoid confusion in future investigations.
   • DAdd the new C2 domain to the organization's threat intelligence feed and share it with relevant partners.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which practice best supports a continuous improvement feedback loop for threat intelligence?

   • ADiscarding all intelligence that produces false positives
   • BKeeping intelligence products static to ensure consistency
   • CRegularly reviewing the effectiveness of intelligence products with operational teams
   • DLimiting feedback to only senior management
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How can threat intelligence help prioritize threats in a cyber operations environment?

   • ABy assessing the relevance and impact of threats to the organization
   • BBy ignoring threats that have not yet been observed in the wild
   • CBy focusing only on threats that have been reported in the news
   • DBy listing all known threats in alphabetical order
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company wants to automate response actions based on threat intelligence, but they are concerned about the risk of automated actions causing unintended damage. They want to implement automation while maintaining human oversight. Which approach best balances automation and control?

   • AAutomate low-risk response actions (e.g., blocking known malicious IPs) and require human approval for high-impact actions (e.g., isolating critical servers).
   • BDisable automation and rely solely on manual response to avoid risk.
   • CAutomate all response actions without human review to ensure speed.
   • DRequire manual approval for all response actions, even low-risk ones.
   Reveal Solution Discussion Select an answer first