Key Differences Between Intelligence, Information, and Data TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security operations center receives a daily threat feed containing thousands of indicators of compromise (IOCs) such as file hashes and domains. The SOC manager asks the analyst to produce a brief that tells the incident response team which IOCs are most relevant to the company's environment and what actions to take. What is the analyst producing, and why?

   • AIntelligence, because the IOCs are analyzed against the company's environment and turned into recommended actions.
   • BInformation, because the IOCs are organized into a list for the team.
   • CData, because the IOCs are raw facts from the feed.
   • DInformation, because the brief is a summary of the feed.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A threat intelligence team is building a pipeline to process raw OSINT data. The team has limited resources and must decide where to invest to maximize the value of the final intelligence product. The team currently has a tool that collects raw data and a tool that generates reports. They need to add a step that will most improve the transformation from data to intelligence. Which step should they add?

   • AA step that sends the raw data to a third-party vendor for a second opinion.
   • BA step that stores the raw data in a data lake for future use.
   • CA step that automatically generates charts and graphs from the raw data.
   • DA step that enriches the raw data with context, such as geolocation and WHOIS, before analysis.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A threat intelligence platform (TIP) receives a feed of domain names that are suspected of being malicious. An analyst enriches the domains with WHOIS information and SSL certificate details. The analyst then reviews the enriched data and determines that the domains are part of a phishing campaign targeting the company's employees. The analyst creates an alert for the security team with recommended actions. Which artifact is best classified as intelligence?

   • AThe enriched domains with WHOIS and SSL details, because they have context.
   • BThe raw domain feed, because it is the original source.
   • CThe analyst's review, because it is a human process.
   • DThe alert with recommended actions, because it interprets the enriched data and supports a response.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A threat intelligence analyst is asked to produce a weekly threat assessment for the executive team. The analyst has collected: (1) a list of malware hashes from internal detections, (2) a vendor report describing the malware's capabilities, and (3) a summary of which business units were affected. The executive team wants to know the likelihood of a similar attack and what resources to allocate. Which final product best meets the definition of intelligence?

   • AA report that assesses the likelihood of recurrence based on the malware's behavior and the affected business units, and recommends specific resource allocations.
   • BA summary that states the facts of the incident and leaves the resource allocation decision to the executive team.
   • CA document that lists the malware hashes, the vendor report, and the affected business units in separate sections.
   • DA presentation that shows the vendor report and the affected business units without additional commentary.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is the primary criterion that distinguishes intelligence from information?

   • AThe speed at which it is produced
   • BThe volume of data involved
   • CThe source of the data
   • DActionable value for decision-making
   Reveal Solution Discussion Select an answer first