Threat Intelligence in Incident Response TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team is integrating threat intelligence into its incident response process. They face the challenge that different team members interpret the same intelligence differently, leading to inconsistent responses. What is the best practice to address this challenge?

   • AUse only automated tools to apply threat intelligence, removing human judgment entirely.
   • BDevelop standardized playbooks that define how specific types of threat intelligence should be used in each incident response phase.
   • CLimit the use of threat intelligence to only the most senior analysts.
   • DAllow each analyst to use their own judgment on how to apply threat intelligence.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During an active incident, the incident response team discovers a new malware variant and its indicators of compromise. The organization is part of an information sharing and analysis center (ISAC) for its sector. What is the most appropriate way to share this threat intelligence during the incident?

   • AShare the information publicly on social media to reach the widest audience quickly.
   • BShare the IOCs and malware analysis with the ISAC immediately, while ensuring that any sensitive details about the organization's internal vulnerabilities are anonymized.
   • CWait until the incident is fully resolved before sharing any information to avoid revealing the organization's weaknesses.
   • DOnly share the information with law enforcement, as they are the only authorized recipients of threat intelligence.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is responding to a ransomware incident and has identified the ransomware family and its encryption behavior. The incident response team wants to share this intelligence with external parties to help others. What is the most important consideration when sharing this threat intelligence?

   • AInclude all internal IP addresses and hostnames to provide complete context.
   • BEnsure that the shared information does not contain sensitive details about the company's internal network architecture or employee data.
   • CShare the information only with law enforcement and not with other organizations.
   • DShare the information only after the incident is fully resolved to avoid legal liability.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   During incident analysis, how does threat intelligence help in attributing an attack?

   • ABy comparing observed tactics, techniques, and procedures (TTPs) with known adversary profiles
   • BBy automatically blocking all traffic from the attacker's country
   • CBy identifying the physical location of the attacker in real time
   • DBy deleting all logs that do not match known indicators
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During an incident investigation, analysts find that the attacker used a specific phishing lure that matches a known campaign targeting their industry. The analysts want to determine if the same attacker is responsible for other suspicious activities in the network. Which use of threat intelligence would best support this analysis?

   • ASearch the threat intelligence platform for other IOCs and TTPs associated with the same campaign and hunt for those in the network logs.
   • BAssume that only the systems with the phishing lure are compromised and end the investigation.
   • CIsolate the affected systems and wait for the attacker to make contact again.
   • DDelete all emails that match the phishing lure and move on.
   Reveal Solution Discussion Select an answer first