Leveraging Predictive and Proactive Threat Intelligence TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team wants to proactively hunt for a specific advanced persistent threat (APT) group that is known to use living-off-the-land binaries (LOLBins). The team has intelligence about the group's tactics, techniques, and procedures (TTPs). Which hunting approach is most effective?

   • AConduct a general vulnerability scan to identify missing patches.
   • BWait for the next antivirus signature update to detect the APT's malware.
   • CSearch endpoints for the specific LOLBins and correlate with other TTPs such as unusual command-line arguments or scheduled tasks.
   • DBlock all LOLBins from executing on endpoints.
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A financial services company is developing a threat model for its new mobile banking application. Historical data shows that most attacks on similar apps come from credential stuffing, but the company's leadership is concerned about the reputational impact of a data breach. The security team has limited resources and must choose a defense priority. Which approach best balances predictive likelihood and potential impact in threat modeling?

   • AImplement all possible controls equally across all attack vectors to avoid missing any threat.
   • BImplement a risk-based approach that scores each attack vector by both likelihood and impact, then allocate resources to the highest-scoring risks.
   • CPrioritize defenses against credential stuffing because it is the most historically likely attack vector, even if the impact is lower.
   • DPrioritize defenses against data breach scenarios because the reputational impact is high, even though they are less likely.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the benefit of integrating predictive and proactive threat intelligence in a security program?

   • AIt guarantees that no security breach will ever occur
   • BIt focuses only on external threats, ignoring internal risks
   • CIt eliminates the need for reactive incident response
   • DIt provides a comprehensive view that helps anticipate and actively counter threats
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst finds a suspicious IP address in a threat intelligence feed that is associated with a new malware campaign. The analyst wants to determine if the organization has been targeted and predict the campaign's next steps. However, the IP address is also used by a legitimate cloud service, causing false positives. Which action best balances the need to investigate with the risk of false positives?

   • ACorrelate the IP address with other indicators such as domain names, file hashes, and behavior patterns before taking action.
   • BSearch only the firewall logs for connections to the IP address and conclude no threat if none are found.
   • CIgnore the IP address because it is shared with a legitimate service.
   • DBlock the IP address immediately at the firewall to prevent any potential communication.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst finds a malicious IP address in a threat intelligence feed that is associated with a command-and-control server. The analyst wants to proactively hunt for any systems in the organization that may have communicated with this IP. Which action is most effective?

   • AShare the IP with other organizations but do not search internally.
   • BSearch the organization's network logs for any connections to the malicious IP address.
   • CBlock the IP address at the firewall and move on to other tasks.
   • DAdd the IP to a watchlist and wait for future alerts.
   Reveal Solution Discussion Select an answer first