Leveraging Predictive and Proactive Threat Intelligence TIE Practice Questions (Page 4)

Questions 16–20

1. 16expert · medium

   A security team has limited staff and must decide between conducting proactive threat hunting and responding to a high volume of daily alerts. The team wants to improve its security posture but is overwhelmed by alert fatigue. Which strategy best balances proactive hunting with operational demands?

   • AOutsource all alert monitoring to a managed security service provider and keep the internal team for hunting.
   • BDedicate a small team to threat hunting on a scheduled basis while using automated triage to reduce alert noise.
   • CStop all alert monitoring to free up time for threat hunting.
   • DOnly conduct threat hunting when a major incident occurs.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization discovers a malicious file hash in a threat intelligence feed. The file is associated with a new ransomware campaign. The security team wants to determine if any internal hosts are already infected and predict the campaign's next move. Which combination of actions is most appropriate?

   • AWait for the antivirus vendor to update signatures and then run a full scan.
   • BDelete the file hash from the feed because it is only one indicator and not relevant.
   • CSearch endpoint logs for the file hash and analyze related network connections to identify infected hosts and potential C2 infrastructure.
   • DBlock the file hash at the email gateway and assume no internal host is infected.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team wants to implement a threat hunting program but has limited staff and budget. They have access to a SIEM with basic correlation rules and a threat intelligence platform. The team wants to maximize the effectiveness of hunting while minimizing manual effort. Which approach is most appropriate?

   • AAssign a single analyst to manually review all logs every day for signs of compromise.
   • BPurchase a commercial threat hunting service and outsource all hunting activities.
   • CWait for the SIEM to generate alerts and then investigate them as they occur.
   • DUse the threat intelligence platform to generate hypotheses and create automated hunting queries in the SIEM that run on a schedule.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A global company wants to establish a threat intelligence sharing program with industry peers. The company is concerned about sharing sensitive information that could reveal its own vulnerabilities. Which approach best balances the benefits of sharing with the need to protect sensitive information?

   • AShare anonymized and sanitized indicators and tactical intelligence while withholding details that could identify specific internal vulnerabilities.
   • BShare all intelligence, including detailed internal vulnerability information, to maximize trust with peers.
   • CShare only strategic intelligence and avoid sharing any technical indicators.
   • DRefuse to share any intelligence to avoid any risk of exposure.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A healthcare organization is updating its threat model. Historical data shows that ransomware groups frequently target healthcare providers via phishing emails that deliver remote access trojans. The organization wants to prioritize defenses against the most likely attack path. Which threat modeling approach best incorporates predictive intelligence to prioritize defenses?

   • APrioritize defenses based on the potential impact of each attack vector, regardless of historical frequency.
   • BList all possible attack vectors equally and implement controls for each one without considering likelihood.
   • CFocus on the attack vector with the highest historical likelihood and implement layered defenses such as email filtering, endpoint detection, and user training.
   • DImplement a broad set of controls that cover all vectors, but only after a breach occurs to validate the model.
   Reveal Solution Discussion Select an answer first