Threat Intelligence Roles, Responsibilities, and Use Cases TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security operations center (SOC) has just received a new threat intelligence feed containing indicators of compromise (IOCs) for a ransomware family that is actively targeting the organization's sector. The SOC manager wants to ensure that the intelligence is used effectively across the team. The team consists of a threat intelligence analyst, a detection engineer, and an incident responder. Which distribution of responsibilities best ensures that the intelligence is turned into actionable protection?

   • AThe analyst validates and enriches the IOCs, the detection engineer creates detection rules from the IOCs, and the incident responder uses the intelligence to guide response if a compromise is detected.
   • BThe analyst creates detection rules, the detection engineer validates the IOCs, and the incident responder enriches the intelligence.
   • CThe detection engineer validates the IOCs, the incident responder creates detection rules, and the analyst uses the intelligence to guide response.
   • DThe incident responder validates the IOCs, the analyst creates detection rules, and the detection engineer uses the intelligence to guide response.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is implementing a new threat intelligence program. The team has hired a threat intelligence analyst, a threat hunter, and an incident responder. The program's goal is to improve the organization's ability to detect and respond to cyber threats. Which set of responsibilities best aligns with the roles to achieve this goal?

   • AThe analyst responds to incidents, the hunter collects threat data, and the incident responder analyzes threat data.
   • BThe incident responder collects threat data, the analyst conducts proactive hunts, and the hunter acts on confirmed threats.
   • CThe analyst collects and analyzes threat data, the hunter proactively searches for threats based on intelligence, and the incident responder acts on confirmed threats.
   • DThe hunter analyzes threat data, the incident responder conducts proactive hunts, and the analyst acts on confirmed threats.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations center (SOC) is reviewing its incident response process after a recent breach. The team includes a threat intelligence analyst, a threat hunter, and an incident responder. The post-incident review reveals that the team lacked visibility into the attacker's activities before the breach was detected. Which improvement best addresses this gap by leveraging the team's roles?

   • AThe incident responder should wait for more alerts from the SIEM before taking action.
   • BThe incident responder should review all past incidents to identify patterns and create new detection rules.
   • CThe threat hunter should proactively search for indicators of compromise and suspicious behavior based on current threat intelligence, rather than waiting for alerts.
   • DThe threat intelligence analyst should focus on collecting more data from external feeds, even if it is not relevant to the organization.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A mid-sized company has a small security team: one analyst, one incident responder, and one threat hunter. The CISO wants to improve the team's ability to detect and respond to targeted phishing campaigns. The analyst has been spending most of their time manually correlating alerts from the SIEM, leaving little time for deep-dive analysis of the latest phishing tactics. The incident responder is often pulled into false-positive investigations. The threat hunter has been focusing on host-based anomalies but has not been incorporating external threat intelligence feeds. Which change would best align the team's roles with their core responsibilities to improve detection and response?

   • AHave the incident responder manually review all SIEM alerts, the analyst conduct threat hunting, and the threat hunter manage the phishing response.
   • BHave the threat hunter automate the SIEM alerts, the analyst respond to incidents, and the incident responder incorporate external intelligence feeds.
   • CHave the analyst automate the SIEM alert correlation, the incident responder focus on validating and responding to true positives, and the threat hunter incorporate external intelligence to proactively search for phishing indicators.
   • DHave the analyst focus on threat hunting, the threat hunter take over incident response, and the incident responder automate the SIEM alerts.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is planning its response to a potential advanced persistent threat (APT) that has been reported in the industry. The team includes a threat intelligence analyst, a threat hunter, and an incident responder. The CISO wants to ensure that the team is prepared to detect and respond to the APT. Which plan best uses the team's roles?

   • AThe hunter researches the APT, the incident responder develops hunting hypotheses, and the analyst updates response playbooks.
   • BThe analyst researches the APT and disseminates findings, the hunter develops hunting hypotheses based on the findings, and the incident responder updates response playbooks.
   • CThe incident responder researches the APT, the analyst develops hunting hypotheses, and the hunter updates response playbooks.
   • DThe analyst develops hunting hypotheses, the hunter updates response playbooks, and the incident responder researches the APT.
   Reveal Solution Discussion Select an answer first