Threat Intelligence and Essential Terminology TIE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A threat intelligence team is asked to support both the executive team and the incident response team. The executive team needs a quarterly risk assessment, while the incident response team needs real-time indicators during an active incident. The team has limited resources and must decide how to allocate their efforts. Which approach best satisfies both needs?

   • AFocus only on the executive report because it is more important for the organization.
   • BProduce only strategic intelligence and let the incident response team use raw data.
   • CProvide the same technical intelligence to both teams to save resources.
   • DProduce strategic intelligence for the executives on a quarterly basis and provide technical intelligence to the incident response team as needed during incidents.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A threat intelligence analyst is evaluating a new open-source feed that provides a list of malicious IPs. The analyst notices that the feed includes many IPs that are also used by legitimate cloud services. The analyst wants to use the feed to block malicious traffic but is concerned about disrupting legitimate services. Which action is most appropriate?

   • ACorrelate the feed with other sources and internal context to identify the most likely malicious IPs before blocking.
   • BBlock all IPs in the feed because it is from an open-source source and is therefore reliable.
   • CBlock only the IPs that are not used by legitimate cloud services, without further analysis.
   • DIgnore the feed because open-source feeds are not trustworthy.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   In the threat intelligence lifecycle, what is the purpose of the feedback stage?

   • ATo automatically block malicious indicators
   • BTo store intelligence in a centralized repository
   • CTo collect raw data from external sources
   • DTo evaluate the intelligence product and refine future intelligence requirements
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security analyst receives a daily feed of IP addresses that have been observed scanning the organization's perimeter. The analyst notices that many of these IPs are also used by legitimate services and wants to prioritize which ones to block. The analyst has access to a commercial threat intelligence platform that provides context about each IP, including associated threat actor groups and their known tactics. Which action best transforms the raw feed into actionable threat intelligence?

   • AStore the raw IP list in a SIEM for future correlation without taking any immediate action.
   • BShare the entire raw feed with all security team members so they can individually decide what to block.
   • CCorrelate the IPs with the platform's context to identify those linked to known threat actors and their TTPs, then block only those with a clear malicious pattern.
   • DBlock all IPs in the feed immediately because they have been observed scanning, which is a clear sign of malicious intent.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security analyst is investigating a potential breach and needs to determine whether a suspicious file hash has been observed in the wild. Which source would be most appropriate to check first?

   • AInternal DNS logs from the organization's own network.
   • BThe MITRE ATT&CK framework website.
   • CAn open-source threat intelligence platform such as VirusTotal or MISP.
   • DA commercial threat intelligence feed that requires a paid subscription.
   Reveal Solution Discussion Select an answer first