Threat Intelligence Feeds, Sources, and Evaluation Criteria TIE Practice Questions (Page 8)

Questions 36–39

1. 36expert · hard

   A large enterprise has two threat intelligence feeds: Feed X provides high-fidelity indicators with a 6-hour delay, and Feed Y provides low-fidelity indicators in near real-time. The SOC needs to block an active phishing campaign that is evolving rapidly. The team has limited analyst time to investigate alerts. Which feed should be the primary source for automated blocking, and why?

   • AFeed X, because high fidelity reduces false positives, which is critical when analyst time is limited.
   • BFeed X, because a 6-hour delay is acceptable for phishing campaigns that typically last days.
   • CFeed Y, because near real-time updates are essential for blocking an evolving phishing campaign.
   • DFeed Y, because automated blocking can tolerate false positives if the campaign is dangerous.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A global company is subject to data residency regulations that require threat intelligence data about their customers to be processed within specific geographic boundaries. They are evaluating a commercial feed that aggregates data globally and a regional feed that operates only within the required region. The commercial feed offers more comprehensive coverage, but the regional feed ensures compliance. Which approach best balances compliance and coverage?

   • AUse only the commercial feed and rely on contractual clauses to ensure compliance.
   • BUse the regional feed for data subject to residency requirements and the commercial feed for non-restricted data.
   • CUse only the regional feed, accepting reduced coverage to ensure full compliance.
   • DUse the commercial feed but configure it to filter out data from the restricted region.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A government agency needs threat intelligence that is authoritative and vetted by trusted sources. They are willing to share information with other agencies in exchange for access to classified or sensitive intelligence. Which source type is most appropriate?

   • AA public OSINT feed that aggregates data from social media and public reports.
   • BA commercial feed that provides generic threat data without sector focus.
   • CAn information-sharing community such as an ISAC or a government-run threat intelligence platform.
   • DAn internal feed based solely on the agency's own incident data.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security team wants to monitor for indicators related to a specific advanced persistent threat (APT) group that has been targeting their sector. They have access to multiple feeds. Which type of feed is most likely to provide the most relevant and specific intelligence on this APT?

   • AA general-purpose open-source feed that aggregates all malware IOCs.
   • BA dark web monitoring service that tracks stolen data sales.
   • CA commercial feed that provides detailed APT group profiles and associated IOCs.
   • DA vulnerability feed that lists CVEs relevant to their software.
   Reveal Solution Discussion Select an answer first