Integrating Threat Intelligence in Cyber Operations TIE Practice Questions (Page 8)

Questions 36–39

1. 36expert · hard

   A security team is evaluating a new threat intelligence feed. The feed provides a large volume of indicators, but many are not relevant to the organization's industry. The team wants to use the feed to improve their security posture without overwhelming their SOC. What is the best approach?

   • AFilter the feed to include only indicators relevant to the organization's industry and critical assets.
   • BUse the feed only for reporting and not for operational detection.
   • CIngest all indicators into the SIEM and let analysts filter them manually.
   • DBlock all IP addresses in the feed to ensure comprehensive protection.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security manager must decide which security controls to invest in for the next fiscal year. The organization has a limited budget and wants to focus on the most relevant threats. Which approach should the manager take?

   • AInvest equally in all types of security controls to ensure comprehensive coverage
   • BDefer all security investments until a major incident occurs
   • CUse threat intelligence to identify the most likely and impactful threats and prioritize controls accordingly
   • DInvest in controls based on the latest vendor marketing materials
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the core principle of intelligence-driven security operations?

   • ACollecting as much data as possible without analysis
   • BRelying solely on automated tools without human input
   • CUsing threat intelligence to prioritize and guide security decisions
   • DReacting to every alert equally regardless of context
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A threat intelligence team has been producing daily reports, but the SOC has not changed its detection rules based on these reports. To ensure that intelligence is actually used to improve security, what should the team do?

   • ASend the reports to more people in the organization
   • BStop producing reports until the SOC starts using them
   • CMake the reports more technical so the SOC can understand them better
   • DCreate a formal process for the SOC to provide feedback on the usefulness of reports and track implementation of recommendations
   Reveal Solution Discussion Select an answer first