Threat Intelligence Roles, Responsibilities, and Use Cases TIE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A threat intelligence analyst has gathered a large volume of raw data from open-source feeds, dark web forums, and internal telemetry. Before this data can be used by the SOC, the analyst must evaluate its relevance, credibility, and actionability. Which responsibility is the analyst performing?

   • AAnalysis
   • BAction
   • CCollection
   • DDissemination
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is understaffed and has only two people: a senior analyst and a junior analyst. The team is responsible for threat intelligence, threat hunting, and incident response. A critical incident occurs, and the senior analyst must lead the response. The junior analyst is left to handle threat intelligence and threat hunting. Which approach best balances the team's responsibilities during the incident?

   • ABoth analysts focus on threat intelligence and ignore the incident until more information is available.
   • BThe senior analyst continues routine threat hunting, and the junior analyst leads the incident response.
   • CThe junior analyst handles incident response, and the senior analyst handles threat intelligence and hunting.
   • DThe senior analyst focuses on incident response, while the junior analyst prioritizes collecting and analyzing threat intelligence that is directly relevant to the incident, and postpones proactive hunting until the incident is resolved.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which threat intelligence role is typically responsible for converting raw data from multiple sources into finished intelligence products that support decision-making?

   • ASecurity architect
   • BThreat hunter
   • CIncident responder
   • DThreat intelligence analyst
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a common use case for threat intelligence in the context of risk management?

   • AReplacing the need for a vulnerability management program
   • BAutomatically patching all vulnerabilities as soon as they are disclosed
   • CPrioritizing remediation efforts based on the likelihood and impact of specific threats
   • DEliminating all security risks from the organization
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security operations center (SOC) has a threat intelligence analyst, a threat hunter, and an incident responder. The SOC manager wants to ensure that threat intelligence is effectively used to support all phases of incident response: preparation, detection, containment, eradication, and recovery. Which distribution of responsibilities best supports this objective?

   • AThe hunter handles recovery, the incident responder handles detection, and the analyst handles eradication.
   • BThe incident responder provides intelligence during preparation, the analyst proactively searches for threats, and the hunter uses intelligence during containment.
   • CThe analyst handles containment, the hunter handles eradication, and the incident responder handles preparation.
   • DThe analyst provides intelligence during preparation and detection, the hunter proactively searches for threats, and the incident responder uses intelligence during containment, eradication, and recovery.
   Reveal Solution Discussion Select an answer first