Threat Intelligence in Incident Response TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During an incident investigation, an analyst discovers a suspicious file on a compromised host. The analyst wants to determine if this file is related to a known threat actor and understand the potential impact. Which action best uses threat intelligence during the analysis phase?

   • ARun the file in a sandbox and ignore external intelligence.
   • BSubmit the file hash to a threat intelligence platform to check for known malware signatures and associated adversary campaigns.
   • CAsk the user if they recognize the file.
   • DDelete the file immediately to prevent further spread.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a best practice for applying threat intelligence in incident response?

   • ASharing all intelligence publicly without considering sensitivity
   • BUsing only commercial intelligence feeds and ignoring internal data
   • CAutomatically blocking all indicators from any feed without verification
   • DCorrelating intelligence with internal telemetry to validate its relevance
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An organization is reviewing its incident response capabilities after a major incident. The review finds that threat intelligence was used reactively, only after the incident was detected, rather than proactively. Which improvement would best address this gap?

   • AEstablish a continuous threat intelligence monitoring process that feeds into proactive threat hunting and detection rule updates.
   • BUse threat intelligence only during the post-incident review to improve future responses.
   • CIncrease the number of incident response team members to handle more incidents.
   • DRely more on external threat intelligence feeds without integrating them into internal processes.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   After a malware incident, the organization wants to ensure that all affected systems are clean before restoring them to production. Threat intelligence indicates that the malware has multiple variants and may have left rootkits. Which recovery validation step is most important?

   • ARestore from backups taken during the incident, as they may contain the malware.
   • BOnly reimage the systems that showed obvious signs of infection, leaving others as is.
   • CRun a standard antivirus scan on each system and assume it is clean if no threats are detected.
   • DPerform a full system reimage from a trusted source and then verify that all system files match known-good hashes.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is responding to a data breach and has identified the attack vector. Which stakeholder group should receive threat intelligence during the incident?

   • AOnly executive leadership, since they are responsible for public relations.
   • BOnly law enforcement, to ensure the investigation is not compromised.
   • CInternal incident response team, executive leadership, and trusted external partners such as ISACs and law enforcement.
   • DOnly the internal incident response team, to avoid leaking sensitive information.
   Reveal Solution Discussion Select an answer first