Leveraging Predictive and Proactive Threat Intelligence TIE Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A security data scientist wants to build a predictive model to forecast which endpoints are most likely to be compromised based on historical attack data. The model must be accurate but also interpretable so that the SOC can understand why an endpoint is flagged. Which approach best meets both requirements?

   • AUse a deep neural network with many hidden layers to maximize predictive accuracy.
   • BUse a random forest model and only report the final prediction without feature importance.
   • CUse a logistic regression model with feature importance analysis to provide both predictions and explanations.
   • DUse a simple rule-based system that flags endpoints based on a single historical indicator.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A university's security team notices that phishing attacks against students increase significantly at the start of each semester. The team wants to use this trend to anticipate and prepare for the next semester's attacks. Which action best applies predictive threat intelligence?

   • AConduct a post-semester review of phishing incidents to identify lessons learned.
   • BImplement a new firewall rule to block all email traffic from outside the university.
   • CSchedule a security awareness campaign and increase email filtering at the beginning of the next semester.
   • DWait for the first phishing email of the semester to be reported before taking action.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large enterprise wants to implement predictive analytics to anticipate cyber threats. The security team has access to years of internal security logs, external threat feeds, and a data science team. However, the organization has strict data privacy regulations that limit the use of personal data in analytics. Which approach best balances predictive capability with privacy compliance?

   • AUse raw personal data from user activity logs to improve model accuracy, regardless of privacy regulations.
   • BOutsource all data analysis to a third party without reviewing their data handling practices.
   • CAvoid using any historical data and rely only on real-time alerts for threat detection.
   • DUse aggregated and anonymized historical security data to train models that identify threat patterns without relying on personal data.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During an investigation, a security analyst discovers a suspicious domain that has been used in recent phishing campaigns. The analyst wants to use this indicator of compromise (IoC) to predict future malicious activity and proactively hunt for related threats in the environment. Which action best accomplishes this goal?

   • AAdd the domain to a threat intelligence feed for future reference but take no further action.
   • BSearch the environment for other communications with the domain and for related infrastructure such as similar domains or IP addresses.
   • CWait for additional IoCs to be reported by external sources before taking action.
   • DBlock the domain on the firewall and close the investigation.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In threat modeling, which of the following is typically used to identify potential attack vectors?

   • AInstalling a honeypot to lure attackers
   • BConducting a penetration test on a live production system
   • CMapping out system components, data flows, and trust boundaries
   • DReviewing firewall logs after an incident
   Reveal Solution Discussion Select an answer first