Key Differences Between Intelligence, Information, and Data TIE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is writing a threat report for the board of directors. The report includes a table of recent phishing email subject lines and a paragraph that explains how these emails are part of a broader campaign targeting the company's financial department, with recommended actions to increase email filtering. Which element of the report is intelligence?

   • AThe list of recipients who received the phishing emails.
   • BThe paragraph explaining the campaign and recommending actions.
   • CThe table of phishing email subject lines.
   • DThe raw email headers from the phishing emails.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security operations center (SOC) receives a high volume of alerts from multiple sources. The SOC manager wants to improve the team's ability to prioritize responses. The team has access to: (1) raw alert logs, (2) a threat intelligence feed that provides context on indicators, and (3) a vulnerability scanner that identifies affected assets. The manager asks the team to produce a daily prioritized list of actions. Which approach best transforms the available data and information into intelligence?

   • AForward the raw alert logs to the threat feed vendor and ask for a prioritized list.
   • BCreate a dashboard that displays raw alerts, threat feed context, and vulnerability data in separate panes.
   • CCorrelate the raw alerts with the threat feed and vulnerability data, then analyze the combined data to rank alerts by risk to critical assets and recommend specific actions.
   • DUse the threat feed's own severity ratings as the prioritized list without further analysis.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What distinguishes information from data?

   • AInformation is automatically actionable
   • BInformation is always quantitative and numerical
   • CInformation is processed, organized, and given context
   • DInformation is raw and unprocessed
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security operations center (SOC) receives a continuous stream of alerts from an intrusion detection system (IDS). Each alert contains a timestamp, source IP, destination IP, and a signature ID. The SOC team has a dashboard that displays these alerts in real time. Which statement correctly describes the alerts as displayed on the dashboard?

   • AThey are data because they are raw facts without additional context or interpretation.
   • BThey are information because the dashboard organizes them in a readable format.
   • CThey are intelligence because they are used by the SOC to make decisions.
   • DThey are information because they are generated by an IDS.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of raw data in a threat intelligence context?

   • AA report stating that the IP address is part of a known botnet
   • BA recommendation to block the IP address at the firewall
   • CA summary of attack patterns associated with the IP address
   • DA log entry showing an IP address and a timestamp
   Reveal Solution Discussion Select an answer first