Threat Intelligence in Incident Response TIE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A security operations center (SOC) receives hundreds of alerts daily. The team is overwhelmed and frequently misses critical alerts. They have access to a commercial threat intelligence feed that provides indicators of compromise (IOCs) and adversary behavior profiles. The SOC manager wants to use this feed to reduce alert fatigue and prioritize the most important alerts. Which approach best leverages threat intelligence to achieve this goal?

   • AFeed all IOCs from the threat intelligence feed directly into the SIEM and create an alert for every match.
   • BUse the adversary behavior profiles to create detection rules that focus on tactics, techniques, and procedures (TTPs) relevant to the organization's industry and environment.
   • COnly use the threat intelligence feed during the containment phase, as it is not useful for detection or triage.
   • DDisable all alerts that do not match the threat intelligence feed, as any alert without a known IOC is likely a false positive.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   After an incident is contained and eradicated, how can threat intelligence be used during the recovery phase?

   • ATo decide whether to report the incident to the media
   • BTo determine which employees should be terminated
   • CTo calculate the exact financial loss of the incident
   • DTo validate that restored systems are free of known indicators of compromise
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   During eradication, threat intelligence is used to:

   • AIdentify all persistence mechanisms used by the adversary to ensure they are removed
   • BRestore systems from backup
   • CDetermine the financial cost of the incident
   • DNotify law enforcement agencies
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company's SOC is integrating a new threat intelligence platform (TIP) into its incident response workflow. The team notices that many indicators from the TIP are outdated and not relevant to their environment, leading to false positives. What is the best practice to address this challenge?

   • ADisable the TIP integration entirely and rely only on internal detection mechanisms.
   • BConfigure the TIP to automatically filter indicators based on the organization's industry, asset types, and risk tolerance before they are sent to detection systems.
   • CManually review every indicator from the TIP before adding it to the detection systems.
   • DIncrease the severity of all alerts generated from TIP indicators to ensure they are not missed.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A security team is integrating threat intelligence into its incident response process. They have a limited budget and need to choose between purchasing a commercial threat intelligence feed or building an internal threat intelligence capability. Which approach is most effective given the constraint?

   • APurchase the most expensive commercial feed to ensure the best coverage.
   • BBuild an internal capability first and avoid external feeds to save money.
   • CUse only free open-source intelligence feeds to avoid any cost.
   • DStart with a commercial feed and gradually build internal capability to tailor intelligence to the organization's environment.
   Reveal Solution Discussion Select an answer first