Threat Intelligence Feeds, Sources, and Evaluation Criteria TIE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard · select all that apply

   A security analyst is evaluating a new threat intelligence feed for potential integration. The feed claims to provide comprehensive coverage of ransomware campaigns. The analyst needs to verify the feed's quality before deployment. Which actions are appropriate to evaluate the feed? (Select all that apply.)

   • AImmediately deploy the feed to production to test its effectiveness.
   • BCheck the feed's update frequency and historical reliability.
   • CCompare a sample of the feed's IOCs against known ransomware indicators from other sources.
   • DAssess whether the feed's IOCs are relevant to the organization's industry and geography.
   Check answers Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of an open-source threat intelligence source?

   • AA publicly accessible blog that publishes analysis of recent malware campaigns.
   • BAn internal incident response report generated by an organization's own security team.
   • CA subscription-based threat intelligence platform that requires a paid license.
   • DA threat intelligence feed provided by a government agency to vetted critical infrastructure operators only.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A threat intelligence analyst is tasked with selecting a feed for a global organization. Feed A provides excellent coverage of threats in North America but is weak in Asia. Feed B provides good coverage in Asia but is weak in North America. The organization has significant operations in both regions. The analyst must choose a single feed due to budget constraints. Which approach is most appropriate?

   • AChoose the feed with the highest volume of IOCs.
   • BChoose Feed B because Asia is a growing market.
   • CChoose the feed that provides the best overall relevance to the organization's threat profile.
   • DChoose Feed A because North America is the headquarters.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A small manufacturing company wants to start a threat intelligence program but has no dedicated security staff. They need a low-maintenance source that provides curated, actionable alerts about threats relevant to their industry. Which type of threat intelligence feed is most appropriate?

   • AAn internal feed built from their own firewall logs only.
   • BA peer-sharing group that shares raw indicators without any analysis.
   • CA commercial feed with a managed service that delivers curated alerts and requires minimal analyst time.
   • DA raw OSINT feed that requires the company to correlate and analyze the data themselves.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is evaluating a new open-source feed. The feed has a large number of IOCs, but many are duplicates of existing feeds and some are outdated. The analyst wants to reduce noise. Which evaluation criteria should be applied to filter the feed?

   • ARelevance and completeness
   • BTimeliness and relevance
   • CCompleteness and accuracy
   • DAccuracy and timeliness
   Reveal Solution Discussion Select an answer first