Threat Intelligence in Incident Response TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During an investigation, an analyst finds that the attacker used a previously unknown malware variant. The analyst wants to understand the attacker's likely next steps. Which use of threat intelligence is most helpful?

   • AAsk other analysts if they have seen the malware before.
   • BDisconnect the system from the network and move on.
   • CMap the malware's behavior to the MITRE ATT&CK framework to identify the adversary's tactics and techniques.
   • DSearch for the malware's hash on public search engines.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the incident response lifecycle, which activity is a primary use of threat intelligence during the preparation phase?

   • AIsolating affected systems to prevent lateral movement
   • BIdentifying the root cause of an ongoing incident
   • CDeveloping and updating incident response playbooks based on known adversary tactics
   • DRestoring systems from clean backups
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has a mature threat intelligence program, but during a recent incident, the incident response team found that the intelligence was not effectively used. The team had access to relevant IOCs but did not act on them quickly enough. What is the most likely cause of this failure?

   • AThe team did not have enough staff to monitor the alerts generated by the IOCs.
   • BThe threat intelligence feed was not trusted by the team, so they ignored the IOCs.
   • CThe IOCs were too generic and did not provide enough context for the team to prioritize them.
   • DThe IOCs were not integrated into the detection systems in a timely manner, so they were not available when the attack occurred.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is responding to a targeted attack by an advanced persistent threat (APT) group. The attackers have used multiple TTPs and have established persistence in several systems. The incident response team must contain the threat while minimizing business disruption. Which containment strategy is most effective?

   • AFocus only on systems with obvious signs of compromise.
   • BWait for the attackers to reveal more of their infrastructure before acting.
   • CDisconnect all internet-facing systems immediately to cut off the attackers.
   • DIsolate affected systems based on the APT's known TTPs and use intelligence to identify all potential footholds before disconnecting.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is responding to a data breach. Threat intelligence reveals that the attacker is using a specific remote access tool (RAT) that communicates over a non-standard port. The incident response team needs to contain the attack. Which containment action is most directly supported by this intelligence?

   • AWait for the attacker to exfiltrate more data to gather more intelligence before taking action.
   • BChange all user passwords and enforce multi-factor authentication.
   • CBlock the non-standard port at the firewall and disable any processes associated with the RAT on affected systems.
   • DConduct a full network scan to identify all devices using the non-standard port, then isolate those devices.
   Reveal Solution Discussion Select an answer first