Integrating Threat Intelligence in Cyber Operations TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is designing its security architecture and wants to ensure that threat intelligence is used not only to detect threats but also to prevent them. Which integration point should be included?

   • AUse threat intelligence only in the SIEM for alert correlation
   • BIntegrate threat intelligence with the email security gateway to block messages from known malicious senders
   • CStore threat intelligence in a separate database for future analysis
   • DShare threat intelligence with external partners but not use it internally
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A threat intelligence team regularly publishes reports, but the SOC rarely uses them. To improve the relevance and usage of intelligence, what should the team do?

   • APublish more detailed reports to increase their value
   • BSolicit feedback from the SOC on what intelligence is needed and adjust reporting accordingly
   • CStop publishing reports because they are not being used
   • DDistribute reports only to senior management
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is an example of integrating threat intelligence into the prevention stage of cyber operations?

   • AAnalyzing a malware sample to determine its behavior
   • BConducting a post-incident forensic investigation
   • CUpdating firewall rules to block known malicious IP addresses
   • DReviewing incident reports to identify lessons learned
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security operations center (SOC) is overwhelmed by a high volume of low-severity alerts. The team wants to use threat intelligence to reduce alert fatigue without missing genuine threats. Which approach best applies intelligence-driven principles to prioritize alerts?

   • ASuppress all alerts for indicators that are not present in the organization's threat intelligence feed.
   • BAssign higher priority to alerts involving indicators that match the organization's threat intelligence feed and context.
   • CIncrease the alert threshold for all alert types to reduce the number of alerts reaching the SOC.
   • DRoute all alerts directly to the incident response team without triage to avoid delays.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company wants to ensure that threat intelligence is used across the entire attack lifecycle, from prevention to response. Which set of integration points should be implemented?

   • AThreat intelligence platform only, because it is the source of all intelligence
   • BFirewall and IDS only, because they are the most critical controls
   • CSIEM only, because it can handle all security functions
   • DEmail gateway, endpoint detection and response (EDR), and SIEM
   Reveal Solution Discussion Select an answer first