Threat Intelligence Feeds, Sources, and Evaluation Criteria TIE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which evaluation criterion for threat intelligence refers to how current the information is?

   • ARelevance
   • BTimeliness
   • CCompleteness
   • DAccuracy
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a characteristic of an internal threat intelligence source?

   • AIt is derived from an organization's own security telemetry, such as firewall logs and incident reports.
   • BIt is published by a national CERT for public consumption.
   • CIt is purchased from a commercial vendor and delivered via API.
   • DIt is available to any organization that subscribes to a public mailing list.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security architect is designing a threat intelligence program. They have a limited budget and need to cover a wide range of threats. They are considering using multiple free open-source feeds instead of one commercial feed. Which approach is most likely to provide adequate coverage while managing costs?

   • AUse only internal telemetry to avoid external feed costs.
   • BUse a single commercial feed to ensure quality and consistency.
   • CUse a single free feed to keep management simple.
   • DUse multiple free feeds and aggregate them in a TIP.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has a limited budget for threat intelligence and must choose between a commercial feed that provides comprehensive, curated intelligence and an open-source feed that provides raw data. The company has a small but skilled security team that can analyze raw data. The company's primary need is to detect targeted attacks against their specific industry. Which choice best meets their needs?

   • AUse only the open-source feed and rely on the team's skills to identify industry-specific threats.
   • BUse the commercial feed because it is curated and comprehensive, despite the higher cost.
   • CUse the commercial feed but only for a trial period to see if it is worth the cost.
   • DUse the open-source feed and supplement it with industry-specific information from sector ISACs.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a common type of threat intelligence feed?

   • AA feed of malicious IP addresses and domains that is updated in near real time.
   • BA feed of daily weather updates for a data center location.
   • CA feed of quarterly financial performance metrics.
   • DA feed of employee training completion records.
   Reveal Solution Discussion Select an answer first