Threat Intelligence and Essential Terminology TIE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How might a Chief Information Security Officer (CISO) use strategic threat intelligence?

   • ATo update firewall rules with the latest malicious IP addresses
   • BTo justify security investments and shape the organization's risk management strategy
   • CTo analyze malware code in a sandbox
   • DTo configure SIEM correlation rules
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security operations team receives a daily feed of indicators from a commercial threat intelligence provider. The feed includes IP addresses, domains, and file hashes. The team automatically blocks all indicators in the feed. After a week, they notice that some legitimate business traffic is being blocked. What is the most likely reason for this issue?

   • AThe team should have blocked only IP addresses and not domains or hashes.
   • BThe feed contains raw data that has not been contextualized or prioritized for the organization's environment.
   • CThe team should have used only open-source feeds to avoid false positives.
   • DThe feed is not from a reliable source, so it contains incorrect indicators.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A threat intelligence team is setting up a new program. They have defined the intelligence requirements and identified the consumers. They are now ready to start collecting data from various sources. According to the threat intelligence lifecycle, what should they do after collection?

   • AAnalyze the data immediately to produce intelligence.
   • BProcess the data to make it usable for analysis.
   • CDisseminate the raw data to the consumers.
   • DCollect more data to ensure completeness.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A threat intelligence team is building a new intelligence capability. They have collected a large volume of data from open-source feeds, internal logs, and commercial subscriptions. According to the threat intelligence lifecycle, what should the team do immediately after collection to ensure the data is useful?

   • AGenerate strategic intelligence reports for executive leadership.
   • BProcess the data into a structured format suitable for analysis.
   • CDisseminate the raw data to all security teams for immediate action.
   • DDiscard any data that does not match known threat actor TTPs.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security analyst is reviewing an alert that triggered on a known malicious IP address. The analyst notices that the IP is also used by a legitimate cloud service provider, and many internal users have accessed it. The analyst must decide whether to block the IP. Which consideration is most important in this decision?

   • AThe IP address is in a commercial threat feed, so it should be blocked immediately.
   • BThe context of the IP address, including its reputation and the behavior of the internal users.
   • CThe IP address is a known IoC, so it must be blocked regardless of context.
   • DThe IP address is a technical indicator, so it is more reliable than tactical intelligence.
   Reveal Solution Discussion Select an answer first