Threat Intelligence Feeds, Sources, and Evaluation Criteria TIE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is deciding between using an open-source feed and a commercial feed. The open-source feed is free but has a higher false-positive rate and less context. The commercial feed is expensive but provides detailed context and lower false positives. The company has a small security team and cannot afford to waste time on false positives. Which factor should be the primary consideration in this decision?

   • AThe accuracy and context provided by the feed.
   • BThe format of the feed.
   • CThe cost of the commercial feed.
   • DThe number of IOCs in the feed.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is comparing two threat intelligence feeds. Feed A has a high false-positive rate but provides indicators within minutes of a new threat emerging. Feed B has a low false-positive rate but indicators are delayed by several days. The analyst's SOC needs to respond to active campaigns quickly but cannot afford to chase false alarms. Which feed should the analyst choose?

   • AFeed A, because timeliness is always the most important criterion.
   • BFeed A, because a high volume of indicators compensates for false positives.
   • CFeed B, because accuracy is more important than timeliness in a SOC with limited resources.
   • DFeed B, because delayed indicators are still useful for future prevention.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services company is required to share threat intelligence with industry peers and government agencies. They also want to receive timely alerts about attacks targeting the financial sector. Which combination of sources best meets these needs?

   • AAn Information Sharing and Analysis Center (ISAC) for financial services and a commercial feed focused on financial threats.
   • BInternal SIEM logs and public OSINT blogs.
   • CDark web monitoring services and social media sentiment analysis.
   • DA single open-source feed that aggregates all global threat data.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A small manufacturing firm has a lean security team and wants to start consuming threat intelligence without spending money on subscriptions. They need indicators of compromise (IOCs) for commodity malware that targets industrial control systems. Which approach best meets their budget and need?

   • AUse only internal telemetry from their own firewalls and endpoints to build a custom feed.
   • BRely solely on vulnerability databases like CVE.org for IOCs.
   • CIncorporate free open-source feeds such as AlienVault OTX and abuse.ch, and cross-reference them with ICS-specific community groups.
   • DSubscribe to a commercial feed that specializes in ICS threats and pay for the premium tier.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team wants to collect threat intelligence from multiple sources, including internal logs, external feeds, and human analysts. They want to ensure that the intelligence is consistent and can be correlated across sources. Which approach best supports this goal?

   • AStore all data in a spreadsheet and manually correlate it.
   • BUse only the external feed and ignore internal logs to reduce complexity.
   • CHave each analyst maintain their own separate notes and compare them monthly.
   • DUse a threat intelligence platform (TIP) that aggregates and normalizes data from all sources.
   Reveal Solution Discussion Select an answer first