Threat Intelligence Roles, Responsibilities, and Use Cases TIE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a limited security budget and must choose between investing in threat intelligence capabilities to improve detection and investing in additional endpoint protection tools. The threat intelligence team argues that intelligence can improve the effectiveness of existing tools, while the endpoint team argues that more tools are needed. Which approach is most likely to provide the best return on investment?

   • AInvest in additional endpoint protection tools
   • BInvest in threat intelligence to enhance the effectiveness of existing security controls
   • CDelay both investments until a major incident occurs
   • DSplit the budget equally between both initiatives
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A large organization has a mature security team with separate roles: a threat intelligence analyst, a threat hunter, and an incident responder. A new advanced persistent threat (APT) group has been observed targeting the organization's industry. The threat intelligence analyst has produced a detailed report on the APT's tactics, techniques, and procedures (TTPs). The CISO wants to ensure that the organization is prepared to detect and respond to this APT. Which combination of actions best leverages the team's roles?

   • AThe analyst disseminates the report to the threat hunter and incident responder; the hunter uses the TTPs to develop hunting hypotheses; the incident responder reviews the TTPs to prepare response playbooks.
   • BThe incident responder disseminates the report, the analyst conducts the hunt, and the hunter prepares the response playbooks.
   • CThe analyst keeps the report confidential and only shares it with the CISO; the hunter and incident responder are not informed.
   • DThe hunter writes the final report, the incident responder conducts the hunt, and the analyst prepares the response playbooks.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large organization has a mature SOC but is seeing an increase in stealthy attacks that bypass existing detection rules. The SOC manager wants to add a role that will proactively search for these threats, but the budget is limited and the SOC is already understaffed. The manager must choose between hiring a dedicated threat hunter or training existing analysts to perform hunting duties part-time. Which approach best balances the need for proactive hunting with the constraint of limited resources?

   • ATrain existing analysts to perform hunting duties part-time
   • BHire a dedicated threat hunter
   • COutsource hunting to a managed security service provider (MSSP)
   • DDefer hunting until the budget increases
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A threat intelligence team is responsible for the full intelligence lifecycle. They have collected a large amount of raw data from multiple sources, but the SOC is complaining that the intelligence they receive is often irrelevant and arrives too late to be useful. The team lead wants to improve the process. Which change should the team make to address both the relevance and timeliness issues?

   • AReduce the frequency of intelligence reports to the SOC
   • BIncrease the volume of data collected from more sources
   • CImprove the analysis phase to filter and prioritize intelligence based on the SOC's requirements
   • DAutomate the dissemination of all raw data to the SOC
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's risk management team is evaluating whether to invest in additional endpoint detection and response (EDR) tools. They ask the threat intelligence team to provide information about the likelihood of a specific threat actor targeting the company and the potential impact of such an attack. Which use case of threat intelligence is being applied?

   • ARisk management
   • BIncident response
   • CVulnerability management
   • DThreat detection
   Reveal Solution Discussion Select an answer first