The Threat Intelligence Generation Process TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A threat intelligence team distributes a monthly report to various departments. The IT operations team says the report is too focused on external threats and does not mention internal vulnerabilities. The executive team says the report is too long and they only want a summary. What should the team do to address this feedback?

   • ASend the same report to everyone but shorten it to one page.
   • BIgnore the feedback because the report is already comprehensive.
   • CStop distributing the report until the team agrees on a single format.
   • DCreate tailored versions of the report for different audiences, including a brief executive summary and a detailed technical section for IT operations.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A multinational corporation is building a threat intelligence program. The legal team requires that all threat data be stored in a specific country due to data residency laws. The threat intelligence team wants to use a commercial threat feed that stores data in a different country. What is the most appropriate approach?

   • AIgnore the legal requirement and use the commercial feed as is, since threat data is not personal data.
   • BFind a threat feed provider that offers data residency in the required country, or use a proxy to collect and store data locally.
   • CUse the commercial feed but ensure that only the final intelligence products are stored in the required country, while raw data remains with the vendor.
   • DCollect data only from internal sources to avoid any cross-border data transfer issues.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An analyst is reviewing a month of proxy logs and notices that several internal hosts repeatedly resolve a domain that is only 24 hours old. The domain was registered with privacy protection and hosts a single page that redirects to a legitimate-looking login portal. Which analytical technique would best help determine if this is a coordinated campaign?

   • ABlock the domain immediately and move on to other alerts.
   • BCorrelate the domain with other recently registered domains and shared infrastructure (e.g., same IP, TLS certificate, or nameserver).
   • CCheck the domain's age and registration details only.
   • DAsk the internal users why they visited the domain.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   After analyzing a series of phishing emails, a threat intelligence analyst has identified a pattern: the emails use a specific subject line and link to a domain that was registered two days ago. The analyst needs to inform the security team and management about this threat. What is the most appropriate way to present this intelligence?

   • ASend an email to the security team with the domain only and no other details.
   • BWrite a detailed research paper on phishing techniques and distribute it to all employees.
   • CWait until more data is collected before informing anyone.
   • DCreate a tactical alert for the security team with the subject line, domain, and recommended email filtering rules, and a brief summary for management.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A small company is building its first threat intelligence capability. The team has limited budget and no dedicated threat intelligence platform. They want to collect data from public sources, internal logs, and a free OSINT feed. Which approach is most appropriate for their data collection phase?

   • AManually copy data from public sources into a spreadsheet without any automation.
   • BUse a combination of automated scripts to pull data from the OSINT feed and internal logs, and manually curate public-source data.
   • CPurchase an expensive commercial threat intelligence platform to automate all collection.
   • DOnly use internal logs and ignore external sources to avoid data overload.
   Reveal Solution Discussion Select an answer first