Threat Intelligence Feeds, Sources, and Evaluation Criteria TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A financial services firm wants to enrich its threat intelligence with real-time information about emerging malware campaigns. They have a mature security team that can handle raw data and wants to minimize subscription costs. Which type of feed is most appropriate?

   • AA commercial feed with analyst-curated reports, despite the higher cost.
   • BA government feed that provides weekly summaries of threat trends.
   • CA free OSINT feed that provides raw indicators and malware samples.
   • DAn internal feed built from their own sandbox detonations.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security operations team is integrating a new threat intelligence feed into their SIEM. The feed provides IOCs in STIX format. The team wants to automate the blocking of malicious domains but is concerned about the risk of blocking legitimate domains due to false positives. Which strategy best mitigates this risk while maintaining automation?

   • ABlock all domains from the feed immediately without review.
   • BManually review every domain before blocking.
   • CBlock only domains that are older than 30 days in the feed.
   • DAutomatically block domains that are also confirmed by at least one other independent feed.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company wants to detect threats that are specific to its own network and employees. They have decided to supplement external feeds with internal sources. Which internal source would provide the most direct evidence of compromised credentials?

   • APublic vulnerability scanners
   • BIndustry reports on ransomware trends
   • CActive Directory authentication logs
   • DSocial media mentions of the company
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company wants to build a threat intelligence program that includes both external and internal sources. They want to ensure that the intelligence is actionable and prioritized based on risk. Which combination of sources and processes best achieves this?

   • AUse only external feeds and rely on the SIEM to prioritize alerts automatically.
   • BUse external feeds and internal data but do not prioritize, to avoid missing any alerts.
   • CCombine external feeds with internal incident data and use a scoring system to prioritize alerts based on relevance and risk.
   • DUse only internal incident data and manually review all alerts.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst is comparing two threat intelligence feeds. Feed A provides indicators that are highly relevant to the organization's industry but has a 12-hour delay. Feed B provides indicators that are less relevant but updates in real-time. The organization's primary concern is a slow-moving APT campaign that has been active for months. Which feed should the analyst prioritize?

   • AFeed A, because a 12-hour delay is still fast enough for any threat.
   • BFeed B, because real-time updates are always more valuable.
   • CFeed B, because timeliness is the most important criterion in all cases.
   • DFeed A, because relevance is more important than timeliness for a slow-moving APT campaign.
   Reveal Solution Discussion Select an answer first