Threat Intelligence and Essential Terminology TIE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A threat intelligence team is asked to provide a monthly report on emerging threats relevant to the organization. They have limited staff and must balance depth with timeliness. The team currently collects data from open-source feeds and internal logs, but has no formal process for prioritizing what to analyze. Which approach best addresses the team's constraint while producing actionable intelligence?

   • ADefine intelligence requirements with stakeholders and use them to prioritize collection and analysis.
   • BAutomate the entire analysis process to eliminate the need for human judgment.
   • CAnalyze all collected data equally to avoid missing any potential threat.
   • DFocus only on commercial feeds because they are more reliable than open-source.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following best illustrates the difference between information and threat intelligence?

   • AInformation is always quantitative; intelligence is always qualitative
   • BInformation is stored in a SIEM; intelligence is stored in a spreadsheet
   • CInformation is a raw log entry; intelligence is the conclusion that the log entry indicates a specific attack pattern
   • DInformation is collected from external sources; intelligence is collected from internal sources
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security analyst receives an alert from a SIEM that matches a known IoC from a commercial feed. The analyst investigates and finds that the IoC is a domain that was recently taken down by law enforcement. The internal traffic to the domain is from a legacy application that is no longer supported. Which action is most appropriate?

   • ATreat the alert as a false positive because the domain is no longer active and the traffic is from a legacy application.
   • BEscalate the alert to the incident response team for further investigation.
   • CBlock the domain immediately because it is a known IoC.
   • DUpdate the SIEM to ignore all alerts from commercial feeds.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security operations center (SOC) manager needs to justify the purchase of a commercial threat intelligence feed to the CISO. The CISO wants to understand how this feed will improve the SOC's ability to detect and respond to threats. Which argument best aligns the feed's value with the SOC's needs?

   • AThe feed provides technical intelligence, such as IoCs, that can be integrated into SIEM and detection rules to improve alert fidelity.
   • BThe feed provides operational intelligence that will replace the need for internal threat hunting.
   • CThe feed provides strategic intelligence that will help the SOC understand the global threat landscape.
   • DThe feed provides tactical intelligence that will automatically patch all vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is reviewing a threat intelligence report that includes a list of IP addresses, a description of a phishing campaign, and an analysis of the adversary's use of living-off-the-land binaries. The analyst needs to explain to a junior team member the difference between the IoCs and the TTPs in the report. Which statement correctly distinguishes them?

   • AIoCs are only used for strategic intelligence, while TTPs are used for technical intelligence.
   • BTTPs are specific artifacts, while IoCs describe the adversary's methods.
   • CIoCs are the same as TTPs because both are used for detection.
   • DIoCs are specific artifacts like IPs and hashes, while TTPs describe the adversary's behavior and methods.
   Reveal Solution Discussion Select an answer first