Threat Intelligence and Essential Terminology TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A small security team wants to start a threat intelligence program with minimal budget. They need to understand the current threat landscape and common attack patterns. They have no existing commercial subscriptions and limited staff time. Which combination of sources would be the most practical starting point?

   • AOpen-source feeds, industry reports, and internal logs from their own environment.
   • BOnly internal logs, because external sources are not relevant to their environment.
   • COnly open-source feeds, because they are free and require no analysis.
   • DCommercial threat intelligence platforms and paid vulnerability databases.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security operations center (SOC) manager wants to improve the team's ability to detect and block specific malware families. The manager asks the threat intelligence team for a report that includes file hashes, C2 domains, and YARA rules. Which type of threat intelligence is the SOC manager requesting?

   • ATechnical intelligence, which provides indicators and detection content.
   • BStrategic intelligence, which provides high-level risk assessments.
   • CTactical intelligence, which describes adversary TTPs.
   • DOperational intelligence, which describes specific attack campaigns.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In threat intelligence terminology, what is an indicator of compromise (IoC)?

   • AA piece of forensic evidence that suggests a system may have been breached
   • BA weakness in a system that could be exploited by a threat actor
   • CThe motivation behind a threat actor's attack campaign
   • DThe likelihood that a specific threat will exploit a vulnerability
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In cybersecurity, what is the primary purpose of threat intelligence?

   • ATo replace the need for vulnerability scanning in an organization
   • BTo automatically block all malicious IP addresses in real time
   • CTo provide evidence-based knowledge about existing or emerging threats that supports informed security decisions
   • DTo guarantee that an organization will never suffer a data breach
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is an example of an open-source threat intelligence source?

   • AA public blog by a security researcher analyzing a recent malware campaign
   • BAn organization's internal firewall logs
   • CA confidential report shared only with government partners
   • DA proprietary threat feed purchased from a commercial vendor
   Reveal Solution Discussion Select an answer first