Threat Intelligence in Incident Response TIE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   After a severe incident, the organization is planning to restore systems from backups. Threat intelligence indicates that the attacker had access to the backup system and may have tampered with backups. The incident response team must ensure that restored systems are clean. What is the most reliable recovery approach?

   • ARestore from backups that are known to be clean, such as offline or immutable backups, and then verify system integrity against known-good baselines.
   • BSkip the backup restoration and rebuild all systems from scratch to ensure they are clean.
   • CUse the backups as-is and rely on antivirus scans to detect any tampering.
   • DRestore from the most recent backups, even if they may be tampered with, to minimize data loss.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a primary way threat intelligence enriches incident data during investigation?

   • ADeleting duplicate alerts to reduce noise
   • BAdding context to indicators such as IP addresses, domains, and file hashes
   • CEncrypting all incident data to protect confidentiality
   • DReplacing all raw logs with summarized reports
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In post-incident activities, threat intelligence is primarily used to:

   • ADelete all logs related to the incident to free up storage
   • BImmediately restore all systems without further analysis
   • CIdentify the attacker's physical location for legal action
   • DUpdate detection rules and improve defenses based on lessons learned
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SOC analyst sees an alert for a suspicious outbound connection from a finance workstation. The threat intelligence feed shows that the destination IP is associated with a known phishing campaign. What should the analyst do first?

   • AIgnore the alert because the IP may be a false positive.
   • BEscalate the alert as a high-priority incident based on the intelligence correlation.
   • CBlock the IP address without further investigation.
   • DWait for additional alerts before taking action.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   After eradicating a sophisticated threat, a company is planning recovery. The threat actor is known to use multiple persistence mechanisms and has a history of re-infection. Which recovery approach is most likely to prevent recurrence?

   • AChange all passwords and assume the threat is gone.
   • BRestore systems from known-good backups, apply security patches, and verify that all known persistence mechanisms are removed.
   • CReconnect systems to the network as soon as possible to minimize downtime.
   • DReimage only the most critical servers and leave others as they are.
   Reveal Solution Discussion Select an answer first