Threat Intelligence and Essential Terminology TIE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A threat intelligence team is evaluating sources for a new program. They have a limited budget and need to cover both external threats and internal activity. Which combination of sources best balances cost and coverage?

   • AOnly open-source feeds and internal logs to keep costs at zero.
   • BOnly internal logs and vulnerability scans to focus on known weaknesses.
   • COpen-source feeds, internal logs, and a low-cost commercial feed for specialized coverage.
   • DOnly commercial feeds from multiple vendors to ensure high-quality data.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A threat intelligence analyst is tasked with producing a report on the likelihood of a specific threat actor targeting the organization. The analyst has collected data from multiple sources. What should the analyst do first to ensure the intelligence is relevant and actionable?

   • ACollect as much data as possible from all available sources.
   • BAnalyze the data without any predefined requirements to avoid bias.
   • CDefine the intelligence requirements and objectives based on the organization's needs.
   • DDisseminate the final report to all stakeholders immediately.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A threat intelligence team produces a daily report containing new malware hashes, phishing domains, and C2 server IPs. Which consumer group is the primary audience for this type of intelligence?

   • ASecurity operations center (SOC) analysts who need to update detection signatures and blocklists.
   • BLegal and compliance teams who need to assess regulatory impact.
   • CHuman resources who need to update employee security awareness training.
   • DExecutive leadership who need to understand business risk.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst receives an alert from a SIEM that a known malicious IP address has been observed in the network logs. The analyst checks the threat intelligence platform and sees that this IP is associated with a specific threat actor group and their recent campaign. The analyst then blocks the IP and searches for other indicators from the same campaign. Which statement best describes the role of the threat intelligence platform in this scenario?

   • AIt replaces the need for the SIEM alert by providing the IP address.
   • BIt provides context that transforms the raw IP address into actionable intelligence.
   • CIt provides raw data that is directly actionable without further analysis.
   • DIt is only useful for blocking IPs and has no other value.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A threat intelligence team produces a weekly report that includes new malware hashes, phishing domains, and C2 IP addresses. The report is distributed to the SOC analysts who use it to update detection rules. Which type of intelligence is this report primarily providing, and who is the primary consumer?

   • AStrategic intelligence for executives to understand business risk.
   • BOperational intelligence for incident responders to investigate specific campaigns.
   • CTechnical intelligence for SOC analysts to improve detection.
   • DTactical intelligence for threat hunters to identify adversary TTPs.
   Reveal Solution Discussion Select an answer first