Threat Intelligence Feeds, Sources, and Evaluation Criteria TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A threat intelligence analyst is comparing two feeds. Feed A provides IOCs within minutes of a new campaign, but lacks context about the attacker. Feed B provides detailed reports but only after the campaign has been active for weeks. The analyst needs to block IOCs quickly. Which feed should be prioritized for immediate blocking decisions?

   • ABoth feeds equally, because they balance each other out.
   • BNeither feed, because both have significant drawbacks.
   • CFeed B, because completeness of context is more important than speed.
   • DFeed A, because timeliness is critical for blocking active threats.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A multinational corporation needs threat intelligence that covers multiple regions and languages. They want to supplement their commercial feed with additional sources that provide local context. Which source type would best provide this local perspective?

   • AA single global OSINT feed that aggregates data from various sources.
   • BA commercial feed that focuses only on their headquarters region.
   • CInternal logs from their own global network.
   • DRegional CERTs and local security blogs that report on threats in their native languages.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security operations center (SOC) is considering adding a new threat intelligence source. The source is a dark web monitoring service that provides early warnings about data breaches and stolen credentials. The SOC already has a commercial feed that provides IOCs but lacks this type of early warning. The SOC has a limited budget and must justify the cost. What is the strongest justification for adding the dark web monitoring service?

   • AIt provides unique, early warning intelligence that complements the existing feed and helps the SOC proactively identify compromised credentials before they are used.
   • BIt replaces the need for the existing commercial feed, reducing overall costs.
   • CIt provides more accurate IOCs than the existing feed, improving detection rates.
   • DIt is the only source that can provide real-time threat intelligence.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is evaluating a threat intelligence feed that has excellent timeliness and relevance but has a known issue: some indicators are not fully validated and occasionally point to legitimate services. The team plans to use the feed for automated blocking in their firewall. What is the most important consideration before enabling automated blocking?

   • AThe completeness of the feed, because more indicators provide better coverage.
   • BThe accuracy of the indicators, because false positives could block legitimate services and cause business disruption.
   • CThe relevance of the feed, because industry-specific indicators are more likely to be accurate.
   • DThe timeliness of the feed, because faster updates reduce the window of exposure.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is evaluating two threat intelligence feeds for integration into their SIEM. Feed X provides a high volume of indicators with a 24-hour delay, while Feed Y provides fewer indicators but updates every 10 minutes. The analyst needs to detect fast-spreading ransomware campaigns in near real-time. Which feed should the analyst prioritize, and why?

   • AFeed Y, because its timeliness is more critical for detecting fast-moving threats than sheer volume.
   • BFeed X, because a higher volume of indicators increases the chance of catching the ransomware.
   • CFeed Y, because fewer indicators always means higher accuracy.
   • DFeed X, because it is more likely to have comprehensive coverage of ransomware variants.
   Reveal Solution Discussion Select an answer first