The Threat Intelligence Generation Process TIE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A threat intelligence analyst is correlating data from multiple sources and finds that a specific domain is consistently queried by several internal hosts, appears in a sandbox analysis report as a C2 callback destination, and is listed in a public blocklist. What is the most appropriate next step in the intelligence generation process?

   • ACollect more raw data on the domain from additional sources before any analysis is performed.
   • BWait for the domain to be confirmed by a government threat intelligence agency before taking any action.
   • CDelete the domain from the blocklist because it appears in multiple sources, which may indicate a false positive.
   • DProduce a finished intelligence report that includes the domain as a high-confidence indicator of compromise (IOC) and disseminate it to relevant stakeholders.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A threat intelligence analyst is reviewing alerts from a SIEM. The analyst notices that a single internal IP address is communicating with multiple external IP addresses on port 445, and some of these external IPs are on a known threat list. The analyst also sees that this pattern occurs only during business hours. What is the most likely conclusion from this correlation?

   • AThe external IPs are likely part of a CDN and the traffic is benign.
   • BThe internal host may be compromised and is likely performing reconnaissance or lateral movement, warranting further investigation.
   • CThe internal host is likely a file server and the traffic is normal business activity.
   • DThe pattern is a false positive and can be ignored.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A small company wants to build a threat intelligence capability but has a limited budget. They need to collect data on threats targeting their industry and region, but they cannot afford commercial threat feeds. Which collection approach is most appropriate?

   • AUse open-source intelligence (OSINT) from public feeds, vendor blogs, and industry information-sharing groups.
   • BPurchase a single commercial feed and cancel all other security tools.
   • CRely solely on internal firewall logs and hope they capture enough external threat data.
   • DWait until a breach occurs and then collect data from the incident.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An analyst notices that a specific malware hash appears in the organization's sandbox detections and also in a public threat feed. The hash is associated with a campaign that targets the same industry. What should the analyst do to turn this observation into actionable intelligence?

   • ADelete the hash from the sandbox logs to avoid false positives.
   • BCorrelate the hash with other indicators (e.g., C2 domains, file names) and produce a report with recommended detection and response actions.
   • CAdd the hash to a blocklist and consider the task complete.
   • DShare the hash with the public without additional context.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A threat intelligence platform ingests data from a SIEM, a threat feed, and a vulnerability scanner. The data is stored in a data lake. Analysts are having difficulty correlating events because the timestamps are in different time zones and formats. What is the most effective way to address this issue?

   • AUse the SIEM's timestamps as the standard and ignore others.
   • BNormalize all timestamps to UTC and a consistent format during the ingestion process.
   • CStore timestamps as strings and parse them during analysis.
   • DConvert timestamps to local time for each analyst.
   Reveal Solution Discussion Select an answer first