Key Differences Between Intelligence, Information, and Data TIE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A threat intelligence analyst is asked to provide the CISO with a recommendation on whether to block a set of IP addresses that have been observed scanning the organization's perimeter. The analyst has the following artifacts: (1) a list of the IP addresses, (2) a threat feed report indicating that the IPs are associated with a known scanning campaign, and (3) a previous incident report showing that similar scanning preceded a ransomware attack on a peer organization. The CISO wants a decision-support product, not just a summary. Which action should the analyst take to produce intelligence?

   • ACombine the IP list, threat feed report, and incident report into a single document that concludes the scanning is likely a precursor to ransomware and recommends blocking the IPs.
   • BCreate a dashboard that displays the IP list and the threat feed report side by side.
   • CForward the threat feed report to the CISO because it already contains the necessary context.
   • DAsk the CISO to decide based on the raw IP list and the threat feed report.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which statement best defines data in the context of threat intelligence?

   • ARaw, unprocessed facts and figures without context
   • BA collection of conclusions drawn from multiple sources
   • CFacts that have been organized and given meaning
   • DAnalyzed information that supports decision-making
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large organization is evaluating a threat intelligence platform. The platform ingests raw logs from multiple sources, automatically deduplicates and formats them, and then applies correlation rules to identify potential threats. The platform's output is a dashboard that shows alerts with recommended actions. The security team is debating whether the dashboard output is intelligence or information. Which argument is most accurate?

   • AThe dashboard is data because it is derived from raw logs.
   • BThe dashboard is information because it is generated by a machine.
   • CThe dashboard is intelligence because it correlates data and provides recommended actions.
   • DThe dashboard is information because it is not a human-written report.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A threat intelligence team is designing a workflow to process raw network telemetry. The team has limited analyst time and must decide where to invest effort to maximize the production of actionable intelligence. The team has the following steps: (1) collect raw packets, (2) filter and normalize the packets into connection records, (3) enrich the records with threat intelligence feeds, (4) analyze the enriched records to identify malicious activity, and (5) write reports with recommended actions. Which step is most critical to ensure the final output is intelligence rather than just information?

   • AStep 2, because filtering and normalizing are necessary to make the data usable.
   • BStep 3, because enrichment adds context from threat feeds.
   • CStep 4, because analysis interprets the enriched data and identifies malicious activity, which is the essence of intelligence.
   • DStep 5, because the report is the final product.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A threat intelligence analyst is reviewing a report from an external vendor that lists indicators of compromise (IOCs) for a new malware strain. The report includes file hashes, domains, and IP addresses, along with a note that these IOCs are associated with a campaign targeting the financial sector. The analyst's organization is in the financial sector. Which statement best describes the value of this report to the organization?

   • AThe report is data because it contains raw IOCs.
   • BThe report is information because it lists IOCs but does not recommend specific actions.
   • CThe report is intelligence because it provides context and indicates relevance to the organization's sector.
   • DThe report is both data and intelligence because it contains raw IOCs and analysis.
   Reveal Solution Discussion Select an answer first