Threat Intelligence and Essential Terminology TIE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A Chief Information Security Officer (CISO) needs to brief the board of directors on the organization's exposure to ransomware and the potential business impact. Which type of threat intelligence is most appropriate for this audience?

   • AOperational intelligence, which focuses on specific campaigns and attacker infrastructure.
   • BTactical intelligence, which details specific attacker tools and techniques.
   • CTechnical intelligence, which lists specific IoCs such as hashes and IP addresses.
   • DStrategic intelligence, which provides high-level trends, risks, and impact analysis.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A threat intelligence analyst is evaluating sources for a new project. The analyst needs information about the latest ransomware tactics and techniques, but has a very limited budget. Which source would be the most appropriate to start with?

   • APublicly available reports from security vendors and industry groups.
   • BDark web monitoring services that require a paid subscription.
   • CA commercial threat intelligence subscription with real-time feeds.
   • DInternal vulnerability scan reports from the organization's own network.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the first stage of the threat intelligence lifecycle?

   • AProcessing
   • BDissemination
   • CCollection
   • DPlanning and direction
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is an example of an internal threat intelligence source?

   • AA public security conference presentation
   • BA commercial threat intelligence subscription
   • CA government cybersecurity advisory
   • DThe organization's own incident response reports
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A threat intelligence analyst has collected a large volume of data from multiple sources, including logs, feeds, and reports. The data is in different formats and contains duplicates and irrelevant entries. The analyst needs to prepare the data for analysis. Which stage of the threat intelligence lifecycle should the analyst perform next?

   • AAnalysis, to derive insights from the data.
   • BCollection, to gather more data to fill gaps.
   • CDissemination, to share the data with stakeholders.
   • DProcessing, to normalize, deduplicate, and filter the data into a usable format.
   Reveal Solution Discussion Select an answer first