The Threat Intelligence Generation Process TIE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the threat intelligence generation process, what is the primary purpose of the 'Production' stage?

   • ATo normalize and structure raw data into a consistent format
   • BTo collect raw data from external feeds and internal logs
   • CTo convert analyzed data into finished intelligence products such as reports and alerts
   • DTo share intelligence with stakeholders and collect feedback
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A threat intelligence analyst has identified a new vulnerability in a widely used software product. The analyst has also found exploit code on a public repository. The analyst needs to produce an intelligence product for the organization's IT team. What is the most appropriate product?

   • AA tactical alert with the vulnerability details, exploit code reference, and recommended patching or mitigation steps.
   • BA raw exploit code dump for the IT team to analyze.
   • CA general advisory for all employees about the vulnerability.
   • DA strategic report on the software vendor's security posture.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the main goal of data normalization in the threat intelligence processing stage?

   • ATo encrypt raw data to protect it from unauthorized access
   • BTo delete all data that is not immediately relevant to the current threat
   • CTo generate final intelligence reports for stakeholders
   • DTo convert raw data into a consistent, structured format that can be analyzed
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A threat intelligence analyst is setting up a data collection process for a manufacturing company. The company has OT (operational technology) networks that are air-gapped from the IT network. The analyst wants to include OT-specific threat data. What is the most appropriate source to collect data from?

   • AGeneral IT threat feeds that focus on web application attacks.
   • BOnly internal OT logs, since the network is air-gapped.
   • CSocial media feeds to monitor general cyber chatter.
   • DOT-specific threat intelligence feeds and ICS-CERT advisories.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A threat intelligence team has just published a weekly report on emerging phishing campaigns. The report is sent to the CISO, the SOC manager, and the incident response team. After reading the report, the SOC manager notes that the indicators of compromise (IOCs) are not in a format that can be directly imported into the SIEM. What should the team do to improve the process?

   • ACollect feedback from the SOC manager and adjust the report format to include machine-readable IOCs (e.g., STIX/TAXII) in future reports.
   • BAsk the SOC manager to manually convert the IOCs into the SIEM format.
   • CStop sending the report to the SOC manager and only send it to the CISO.
   • DIgnore the feedback because the report is already approved by the CISO.
   Reveal Solution Discussion Select an answer first