Threat Intelligence Feeds, Sources, and Evaluation Criteria TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A healthcare organization is evaluating threat intelligence sources to support its incident response team. They need indicators of compromise (IOCs) that are specific to the healthcare sector and have been validated by analysts. Which source type best fits this requirement?

   • AAn internal feed derived solely from the organization's own past incidents.
   • BA government alert feed that provides general threat information without sector focus.
   • CA commercial threat intelligence provider that offers sector-specific feeds with analyst validation.
   • DA public OSINT repository that aggregates raw IOCs from multiple sources.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst notices that a threat intelligence feed frequently reports IOCs that turn out to be false positives when checked against their environment. The feed also lags behind other sources in reporting new campaigns. Which two evaluation criteria are most clearly deficient?

   • AAccuracy and timeliness
   • BTimeliness and relevance
   • CAccuracy and completeness
   • DRelevance and completeness
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which statement best describes the purpose of a threat intelligence feed?

   • AA collection of raw network logs stored in a SIEM for historical analysis and compliance purposes.
   • BA manual list of known vulnerabilities compiled by an internal security team for quarterly review.
   • CA one-time report produced by an analyst that summarizes a specific cyberattack and its impact on an organization.
   • DA continuously updated stream of structured data that provides indicators of compromise and other threat-related information for automated or manual consumption.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A threat intelligence team is reviewing a feed that provides IOCs for a specific campaign. The feed includes hashes, IPs, and domains, but lacks information about the attacker's TTPs or the campaign's objectives. The team needs to understand the threat actor's behavior to improve detection. Which evaluation criterion is most deficient in this feed?

   • ATimeliness
   • BCompleteness
   • CRelevance
   • DAccuracy
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is considering using a free open-source feed for their threat intelligence. They are concerned about the reliability and sustainability of the feed. Which factor is most important to evaluate before relying on it?

   • AThe format of the feed (e.g., CSV vs. STIX).
   • BThe geographic focus of the feed.
   • CThe reputation and maintenance activity of the feed provider.
   • DThe number of IOCs in the feed.
   Reveal Solution Discussion Select an answer first