Threat Intelligence in Incident Response TIE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security operations center (SOC) receives hundreds of alerts daily. The team wants to use threat intelligence to reduce alert fatigue and focus on the most critical incidents. Which approach best applies threat intelligence to improve triage?

   • AAssign all alerts to the most senior analyst for manual review.
   • BPrioritize alerts by correlating them with indicators of compromise (IOCs) and adversary behavior from threat intelligence feeds.
   • CIncrease the alert threshold to reduce the number of alerts generated by the SIEM.
   • DAutomatically block all IP addresses that appear in threat intelligence feeds.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Why is sharing threat intelligence with relevant stakeholders important during an incident?

   • AIt eliminates the need for internal incident response procedures
   • BIt guarantees that the incident will not recur
   • CIt enables coordinated response and helps others protect against the same threat
   • DIt is required by law in all jurisdictions
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security team wants to integrate threat intelligence into its detection and response processes. They have a SIEM and a threat intelligence platform (TIP). Which integration approach is most effective?

   • ADisable the SIEM's correlation rules to avoid false positives.
   • BManually copy IOCs from the TIP into the SIEM once a week.
   • CAutomate the ingestion of IOCs from the TIP into the SIEM to generate alerts on matches.
   • DUse the TIP only for reporting after incidents are closed.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   During the containment phase, how can threat intelligence be incorporated to improve effectiveness?

   • ABy ignoring intelligence and focusing only on the initially compromised host
   • BBy identifying all systems that share the same indicators or are reachable via the same adversary techniques
   • CBy immediately restoring all systems from backup without further analysis
   • DBy deleting all user accounts that were active during the incident
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   After eradicating a threat from a compromised server, the incident response team is planning recovery. Which action best uses threat intelligence to ensure the system is safe to restore to production?

   • AReconnect the server to the network immediately to minimize downtime.
   • BRestore from the most recent backup without checking for backdoors.
   • CChange the server's IP address and hostname to avoid detection.
   • DScan the server with updated antivirus and verify that all known IOCs are absent before reconnecting.
   Reveal Solution Discussion Select an answer first