The Threat Intelligence Generation Process TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security operations center (SOC) analyst is tasked with building a threat intelligence feed for a financial institution. The analyst has access to internal firewall logs, DNS query logs, and a commercial threat feed. The analyst notices that the commercial feed contains IP addresses in a format that differs from the internal logs, and many entries are duplicates. Which sequence of actions best aligns with the threat intelligence generation process?

   • AUse only the internal logs for analysis and discard the commercial feed because it is external data.
   • BStore the raw data in a data lake and wait for a security incident to occur before analyzing it.
   • CNormalize the commercial feed to match the internal log format, deduplicate entries, then correlate the combined dataset to identify indicators relevant to the institution.
   • DImmediately block all IP addresses from the commercial feed, then generate a report for the management team.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of correlation in the analysis stage of threat intelligence generation?

   • ATo combine data points from different sources to identify patterns and potential threats
   • BTo share intelligence with external partners
   • CTo remove all irrelevant data from the dataset
   • DTo format data into a standard structure for storage
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An analyst is investigating a series of alerts involving a legitimate cloud storage service being used to host malware. The malware is downloaded by several employees, but the domain is widely used for legitimate business purposes. The analyst must produce intelligence that reduces risk without disrupting business operations. What is the most appropriate action?

   • ACorrelate the specific file hashes and download URLs with other indicators, and recommend blocking only the malicious files and URLs.
   • BAlert all employees to stop using the cloud storage service.
   • CBlock the entire cloud storage domain to prevent any further downloads.
   • DIgnore the alerts because the domain is legitimate.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A threat intelligence team has identified a new vulnerability in a widely used software product. The team needs to inform their organization's IT team, executives, and possibly external partners. The vulnerability is not yet publicly disclosed, and the team wants to avoid causing panic. What is the most appropriate dissemination strategy?

   • ATell only the executives and let them decide what to do.
   • BSend the full technical details to all employees to ensure awareness.
   • CPublish the vulnerability details on a public forum to warn the community.
   • DDisseminate a controlled advisory to the IT team with technical details and a separate high-level notice to executives, with a plan for broader disclosure if needed.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team is ingesting threat data from multiple sources. They notice that the same IP address is reported as malicious by one source and benign by another. The team needs to decide how to handle this conflict before the data is used in detection rules. What is the best approach?

   • AApply a confidence scoring mechanism based on source reliability and corroborating evidence.
   • BDiscard the IP address from all sources to avoid confusion.
   • CAlways trust the source that says the IP is malicious.
   • DUse the IP in detection rules and let the analysts investigate every alert.
   Reveal Solution Discussion Select an answer first