Integrating Threat Intelligence in Cyber Operations TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security manager wants to implement intelligence-driven security operations. They have a limited budget and need to decide where to invest first. Which approach best aligns with intelligence-driven principles?

   • AFocus solely on purchasing new detection tools without considering intelligence integration.
   • BHire additional analysts to manually review all threat intelligence reports.
   • CPurchase the most expensive threat intelligence platform available to ensure comprehensive coverage.
   • DStart by integrating existing threat intelligence into the current SOC workflows and alert triage.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   After a security incident, the incident response team discovers that the threat intelligence feed used did not contain indicators for the attack technique that was used. What should the team do to improve future detection?

   • AIncrease the frequency of feed updates to every hour
   • BDisable the threat intelligence integration because it failed to detect the attack
   • CProvide feedback to the threat intelligence team about the missing indicators and update the intelligence requirements
   • DReplace the threat intelligence feed with a different vendor's feed
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   After a ransomware incident, the incident response team identifies that the threat actor used a new variant of malware that was not in any threat intelligence feed. The team wants to ensure that future incidents are detected. What is the most effective action?

   • AIncrease the frequency of threat intelligence feed updates
   • BShare the malware sample and indicators with the threat intelligence community and update internal detection rules
   • CAdd the malware hash to the blocklist and move on
   • DDisable the threat intelligence feeds because they failed to detect the ransomware
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In security orchestration, how does threat intelligence typically trigger a response action?

   • ABy replacing the need for security policies
   • BBy matching an observed indicator against a known threat feed to initiate a predefined playbook
   • CBy generating a new threat feed for each incident
   • DBy manually reviewing every alert before any action is taken
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is a primary benefit of using threat intelligence to automate security controls?

   • AIt guarantees that no false positives will occur
   • BIt enables faster response to known threats by automatically updating defenses
   • CIt eliminates the need for human security analysts
   • DIt ensures all security controls are configured identically
   Reveal Solution Discussion Select an answer first