Leveraging Predictive and Proactive Threat Intelligence TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team suspects that a sophisticated adversary may have already compromised their network, but existing security controls have not detected any alerts. The team wants to proactively search for hidden threats that may have evaded detection. Which approach is most aligned with proactive threat hunting?

   • AReview the latest threat intelligence reports and then search endpoints and network traffic for indicators and behaviors described in those reports.
   • BIncrease the frequency of antivirus signature updates on all endpoints.
   • CWait for the next scheduled penetration test to identify any vulnerabilities.
   • DDisable security controls temporarily to see if any malicious activity becomes visible.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A mid-sized company wants to reduce the risk of a targeted attack without waiting for a known threat to appear. The security team has limited budget and wants to actively mislead attackers while also learning about their techniques. Which proactive defense strategy best fits these constraints?

   • ADeploy decoy systems and fake credentials (honeypots) to attract attackers and observe their behavior.
   • BIncrease the frequency of full-disk backups to ensure quick recovery after a breach.
   • CPurchase a larger SIEM license to collect more logs and hope to detect attacks faster.
   • DWait for the next threat intelligence report to identify new attack vectors before taking action.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   How can IoC analysis contribute to proactive threat hunting?

   • ABy analyzing only the most recent malware samples
   • BBy focusing solely on network traffic without considering host-based indicators
   • CBy waiting for alerts from the SIEM to trigger an investigation
   • DBy using known IoCs to search for hidden threats within the environment
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A retail company is updating its threat model. Historical data shows that attackers frequently exploit unpatched point-of-sale (POS) systems during holiday shopping seasons. The security team wants to prioritize defenses for the upcoming holiday period. Which action best applies threat modeling combined with predictive intelligence?

   • AApply equal security controls to all assets to avoid bias in the threat model.
   • BRank POS systems as high-risk assets and schedule accelerated patching and additional monitoring before the holiday season.
   • CIncrease the frequency of vulnerability scans only after the first breach is detected.
   • DDeploy deception technology on the corporate email server because phishing is always the initial vector.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security architect is designing a proactive defense strategy. The organization has a low tolerance for false positives and limited security staff. The architect wants to use deception technology to detect attackers early, but is concerned about the operational overhead of managing decoys. Which approach best balances early detection with limited resources?

   • ADeploy hundreds of low-interaction honeypots across the entire network to maximize coverage.
   • BDeploy a small number of high-interaction honeypots in critical network segments and integrate alerts with the existing SIEM.
   • CSet up honeypots but do not connect them to the SIEM to avoid alert fatigue.
   • DUse only open-source threat intelligence feeds to identify threats and avoid deception technology altogether.
   Reveal Solution Discussion Select an answer first