Threat Intelligence Feeds, Sources, and Evaluation Criteria TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is evaluating a new threat intelligence feed. The feed provides indicators that are highly relevant to their industry, but the source has a history of occasionally providing outdated indicators that have already been remediated. The analyst needs to minimize false positives in their SIEM. Which evaluation criterion should the analyst weigh most heavily?

   • ACompleteness, because more indicators mean fewer false positives.
   • BTimeliness, because faster updates always reduce false positives.
   • CAccuracy, because outdated indicators can cause false positives and wasted investigations.
   • DRelevance, because industry-specific indicators are always accurate.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security operations center (SOC) wants to enrich its internal alerts with external context about emerging ransomware campaigns. They need a feed that provides narrative reports, attacker TTPs, and recommended mitigations, not just raw IOCs. Which type of feed best fits this requirement?

   • AAn internal feed generated from the organization's own incident response cases.
   • BA strategic feed that summarizes geopolitical trends and high-level risk assessments.
   • CA tactical feed that delivers hashes, IPs, and domains in STIX/TAXII format.
   • DAn operational feed that includes campaign analysis, TTPs, and mitigation recommendations.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is considering using a public OSINT feed as a primary source of threat intelligence. The feed is free and provides a large volume of indicators, but the company has a small security team that is already overwhelmed. What is the main risk of relying on this feed?

   • AThe feed may contain a high number of false positives and require significant analyst time to triage.
   • BThe feed will not be compatible with their SIEM.
   • CThe feed is illegal to use in some jurisdictions.
   • DThe feed is likely to be unavailable during peak times.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A regional bank's security team is building a threat intelligence program. They need to monitor for phishing domains targeting their customers and for malware campaigns that specifically impersonate their banking portal. They have a limited budget and want to start with sources that provide immediate, actionable data tailored to their sector. Which combination of sources best meets their needs?

   • APurchase a general-purpose commercial feed that covers all industries and skip internal data collection to save effort.
   • BUse only internal data from past incidents and ignore external feeds to avoid noise.
   • CSubscribe to a commercial threat intelligence feed that specializes in financial-sector indicators and also set up internal collection from their own firewall and email gateway logs.
   • DRely solely on free open-source intelligence (OSINT) feeds such as public blocklists and malware repositories.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   When evaluating a threat intelligence report, which criterion assesses whether the information is applicable to your organization's industry and infrastructure?

   • ARelevance
   • BTimeliness
   • CCompleteness
   • DAccuracy
   Reveal Solution Discussion Select an answer first