Threat Intelligence in Incident Response TIE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An organization is designing its incident response plan and wants to integrate threat intelligence across all phases. Which approach best ensures that threat intelligence is effectively used throughout the incident response lifecycle?

   • AUse threat intelligence only during the detection phase, as it is not useful for later phases.
   • BAssign a single analyst to be responsible for all threat intelligence use during an incident.
   • CIncorporate threat intelligence into the plan by defining specific intelligence requirements for each phase, such as using IOCs for detection and TTPs for analysis.
   • DWait until an incident occurs to determine how to use threat intelligence.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   An analyst receives an alert for a suspicious outbound connection to an IP address that is listed in a threat intelligence feed as a known command-and-control (C2) server. How should the analyst use this intelligence in triage?

   • AIgnore the alert because threat intelligence feeds are always outdated
   • BClose the alert as a false positive because the IP is not on the organization's blocklist
   • CTreat the alert as a high-priority potential incident because the indicator is associated with a known malicious infrastructure
   • DWait for the user to confirm whether they visited the IP before taking any action
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An organization wants to improve its incident detection capabilities by incorporating threat intelligence into its SIEM. The security team has access to a feed of malicious IP addresses and domains. Which integration method would be most effective for using this intelligence in detection?

   • AStore the IOC list in a spreadsheet and share it with the team for reference.
   • BUse the IOC list only for post-incident forensics, not for real-time detection.
   • CManually check each alert against the IOC list during triage.
   • DImport the IOC list into the SIEM and create correlation rules that alert when any of the IOCs are observed in network traffic or logs.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which method is commonly used to integrate threat intelligence into detection activities?

   • ADeleting suspicious files from the system
   • BFeeding indicators of compromise (IOCs) into security information and event management (SIEM) or intrusion detection systems (IDS)
   • CDisabling all external network connections during an incident
   • DManually reviewing all logs after an incident is confirmed
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization has confirmed a ransomware infection that is spreading laterally. Threat intelligence indicates that the ransomware uses a specific set of command-and-control (C2) domains and exploits a known vulnerability in a legacy service. The incident response team needs to contain the outbreak quickly. Which containment strategy best leverages the available threat intelligence?

   • ABlock the identified C2 domains at the firewall and apply a virtual patch or workaround for the vulnerable legacy service on all affected systems.
   • BDisconnect all systems from the network and power them off to stop the spread, then restore from backups.
   • CChange all user passwords and enforce multi-factor authentication across the organization.
   • DWait for the ransomware to encrypt all systems, then pay the ransom to regain access.
   Reveal Solution Discussion Select an answer first