Threat Intelligence in Incident Response TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After a security incident, the incident response team is planning recovery actions. Threat intelligence reports indicate that the attacker used a previously unknown backdoor that is now publicly documented. Which recovery step should the team prioritize to ensure the backdoor is fully removed and the system is safe to restore?

   • AReimage all systems from the original vendor media, but do not apply any patches to maintain system stability.
   • BRestore systems from backups taken before the incident, then apply all security patches and verify the absence of the documented backdoor.
   • CConduct a lessons-learned meeting before any recovery actions to document what happened.
   • DSimply delete the backdoor file from affected systems and resume normal operations.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company wants to incorporate threat intelligence into its detection capabilities. They have a SIEM and want to detect known malicious IP addresses. Which method is most effective?

   • AImport the IP address indicators into the SIEM as correlation rules that generate alerts when matched.
   • BBlock all IP addresses from the feed at the firewall without testing.
   • CStore the IP addresses in a spreadsheet for reference.
   • DManually check each IP address against a threat feed during incident response.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team is integrating threat intelligence into its incident response process but is overwhelmed by the volume of indicators from multiple feeds. What is the best practice to address this challenge?

   • ADisable all external feeds and rely only on internal intelligence.
   • BUse all indicators from all feeds without filtering to ensure complete coverage.
   • CManually review every indicator to determine its relevance.
   • DConsolidate feeds into a single threat intelligence platform and apply context-based scoring to prioritize relevant indicators.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following best describes how threat intelligence supports incident triage?

   • AIt automatically resolves all alerts without human analysis
   • BIt guarantees that no false positives will occur
   • CIt provides context that helps analysts determine the severity and credibility of alerts
   • DIt replaces the need for a formal incident response plan
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company has identified that a specific threat actor is using a particular set of tools and techniques. The incident response team is planning containment. Which strategy is most informed by threat intelligence?

   • AShut down the entire network to prevent any further activity.
   • BContain only the systems that have shown obvious signs of compromise.
   • CFocus containment on systems that exhibit the actor's known TTPs and use indicators to identify all affected hosts.
   • DWait for the actor to reveal more of their infrastructure before acting.
   Reveal Solution Discussion Select an answer first