The Threat Intelligence Generation Process TIE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which sequence best represents the overall threat intelligence generation process from raw data to actionable insights?

   • ACollection → Processing → Analysis → Production → Dissemination
   • BAnalysis → Collection → Production → Processing → Dissemination
   • CProduction → Collection → Analysis → Dissemination → Processing
   • DDissemination → Processing → Collection → Analysis → Production
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of the dissemination stage in the threat intelligence generation process?

   • ATo analyze data for patterns and threats
   • BTo normalize data into a consistent format
   • CTo deliver finished intelligence to the appropriate stakeholders in a timely manner
   • DTo collect raw data from external sources
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A threat intelligence team has developed a new automated alert system that sends real-time alerts to the SOC. However, the SOC team reports that they are receiving too many false positives and are starting to ignore the alerts. The team needs to improve the system. What is the most effective way to address this using the feedback loop?

   • ACollect detailed feedback from the SOC on which alerts are false positives and use this data to refine the correlation rules and thresholds.
   • BStop sending alerts to the SOC and only send them to the incident response team.
   • CIncrease the sensitivity of the alert system to catch more potential threats.
   • DReduce the number of alerts by sending only the most critical alerts, regardless of feedback.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations center collects firewall logs, DNS logs, and threat feeds from multiple vendors. Analysts notice that the same IP address appears in different formats across sources (e.g., with and without leading zeros, and in both IPv4 and IPv6 notations). To ensure the correlation engine can match these entries, what should the team do first?

   • ANormalize the data into a common schema and standardize IP address formats before correlation.
   • BRun the correlation rules directly on the raw data to avoid losing any information.
   • CStore all data in its original format and rely on the analysts to manually match entries.
   • DDiscard any log entries that do not match a predefined format.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   After analyzing a series of malware samples, a threat intelligence analyst has identified a new ransomware family and its command-and-control (C2) infrastructure. The analyst needs to share this information with the incident response team and the network security team. What is the most appropriate intelligence product to produce?

   • AA strategic intelligence report focusing on the geopolitical implications of the ransomware family.
   • BA general news article about the ransomware family for public release.
   • CA tactical intelligence report containing IOCs (hashes, IPs, domains) and recommended detection and blocking rules.
   • DA raw data dump of all the malware samples and logs for the teams to analyze themselves.
   Reveal Solution Discussion Select an answer first