Threat Intelligence in Incident Response TIE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is responding to a zero-day exploit that is actively being used in the wild. The incident response team has identified the exploit's indicators but is unsure about the full scope. They want to share intelligence with the broader community. What is the most important consideration?

   • AShare only the exploit code with the public to help researchers.
   • BKeep all information confidential to avoid tipping off the attackers.
   • CShare the indicators and any available mitigation steps with trusted partners and security vendors as soon as possible.
   • DWait until the incident is fully contained before sharing any information.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An incident responder is analyzing a compromised host and finds a connection to an IP address that is listed in a threat intelligence feed as a known C2 server. What is the most valuable next step?

   • AUse the intelligence to search for other hosts that may have communicated with the same C2 server.
   • BIgnore the connection because the IP may be legitimate.
   • CBlock the IP address and close the investigation.
   • DImmediately reimage the host to ensure it is clean.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   During an incident, the response team discovers that the attacker is using a zero-day exploit. The team has limited information about the exploit but has identified the attacker's infrastructure. The organization is part of a threat intelligence sharing community. What is the most appropriate sharing action during the incident?

   • AWait until the zero-day is fully understood before sharing any information.
   • BShare the attacker's infrastructure indicators and any observed TTPs with the sharing community, while withholding details that could compromise the ongoing investigation.
   • CShare the zero-day exploit code with the community to help them develop defenses.
   • DOnly share the information with law enforcement and not with the sharing community.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does threat intelligence help in developing a containment strategy?

   • ABy providing a list of all employees to suspend
   • BBy recommending the immediate deletion of all files on affected systems
   • CBy automatically shutting down the entire network
   • DBy identifying the adversary's lateral movement techniques to determine which systems to isolate
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   During an incident, analysts find that the attacker used a legitimate remote administration tool (RAT) that is also used by the organization's IT team. Threat intelligence shows that this RAT is commonly abused by a specific threat group. The analysts need to determine if the activity is malicious or legitimate. Which approach best uses threat intelligence to make this determination?

   • ACheck if the RAT's hash matches any known malicious hashes in the threat intelligence feed.
   • BBlock the RAT entirely from the network to prevent any potential abuse.
   • CCompare the observed RAT activity with the threat group's known TTPs, such as specific command-line arguments, file paths, and timing patterns.
   • DAssume the activity is legitimate because the RAT is a legitimate tool used by the IT team.
   Reveal Solution Discussion Select an answer first