Threat Intelligence and Essential Terminology TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A threat intelligence team is building a new capability. They have identified a need to collect data from internal logs, open-source feeds, and commercial subscriptions. Before they start collecting, they want to ensure that the collected data will be relevant to the organization's specific risks and that the final product will be used by the incident response team. According to the threat intelligence lifecycle, which stage should they focus on first?

   • AProcessing, to normalize the data into a usable format.
   • BDissemination, to ensure the final product reaches the incident response team.
   • CCollection, because without data there is nothing to analyze.
   • DDirection, to define the intelligence requirements and the consumers' needs.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which term refers to the behaviors, tools, and procedures that a threat actor uses to conduct an attack?

   • AIndicators of compromise (IoCs)
   • BAttack surface
   • CTactics, techniques, and procedures (TTPs)
   • DRisk appetite
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which role is most likely to use tactical threat intelligence to improve security controls and detection rules?

   • AChief executive officer (CEO)
   • BHuman resources director
   • CSecurity analyst
   • DMarketing manager
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst receives a daily feed of IP addresses and domain names that were observed in recent malware campaigns. The analyst wants to use this feed to prioritize which alerts to investigate. Which statement best describes the nature of this feed and its appropriate use?

   • AIt is tactical threat intelligence that can be directly applied to block all malicious activity.
   • BIt is information that can be used without further analysis because it comes from a trusted commercial source.
   • CIt is a set of indicators of compromise (IoCs) that alone are sufficient to determine the threat actor behind the campaign.
   • DIt is raw data that becomes threat intelligence only after it is contextualized and analyzed for relevance to the organization.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A threat intelligence team is preparing a briefing for the chief information security officer (CISO) about the top cyber threats facing the organization over the next year. The briefing should include the potential business impact and recommended investments. Which type of threat intelligence is most appropriate for this briefing?

   • AOperational intelligence, which describes specific campaigns and indicators.
   • BStrategic intelligence, which focuses on long-term trends and business risk.
   • CTactical intelligence, which details specific attack tools and techniques.
   • DTechnical intelligence, which includes IoCs for detection.
   Reveal Solution Discussion Select an answer first