Threat Intelligence and Essential Terminology TIE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A large organization has a mature threat intelligence program. The SOC manager needs to prioritize which indicators to block at the perimeter. The threat intelligence team has provided a list of IoCs from a recent campaign, but the SOC manager is concerned about false positives that could disrupt business operations. The team also has access to tactical intelligence that describes the adversary's preferred tools and techniques. Which approach best balances the need for immediate protection with the risk of disrupting business?

   • ABlock all IoCs immediately to ensure maximum protection against the campaign.
   • BBlock only the IoCs that are directly tied to the adversary's known TTPs and have a high confidence score.
   • CIgnore the IoCs and rely on tactical intelligence to update detection rules.
   • DBlock the IoCs only after confirming each one with an external commercial feed.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A threat intelligence team is struggling to get stakeholders to act on their reports. The SOC analysts say the reports are too high-level, while the executives say they are too technical. The team has been producing a single weekly report for everyone. Which change to the intelligence lifecycle would best address this problem?

   • AIn the direction stage, define separate intelligence requirements and tailor products for each consumer group.
   • BIn the analysis stage, use more advanced analytical techniques.
   • CIn the collection stage, collect more data to make the reports more comprehensive.
   • DIn the dissemination stage, send the same report more frequently.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What distinguishes threat intelligence from raw data such as a list of IP addresses?

   • AThreat intelligence is always collected from commercial sources
   • BThreat intelligence contains only indicators of compromise
   • CThreat intelligence has been analyzed and contextualized to support decision-making
   • DThreat intelligence is always presented in a visual dashboard format
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which type of threat intelligence is primarily composed of indicators of compromise (IoCs) such as IP addresses, domains, and file hashes?

   • AOperational threat intelligence
   • BTechnical threat intelligence
   • CTactical threat intelligence
   • DStrategic threat intelligence
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which type of threat intelligence is most useful for informing long-term security strategy and executive decision-making?

   • ATechnical threat intelligence
   • BTactical threat intelligence
   • COperational threat intelligence
   • DStrategic threat intelligence
   Reveal Solution Discussion Select an answer first