Threat Intelligence Roles, Responsibilities, and Use Cases TIE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A threat intelligence team has identified a new malware campaign targeting the company's industry. The team has produced a detailed analysis, but the SOC and the executive team have different needs: the SOC needs technical IOCs to update detection rules, while the executives need a high-level summary of the business impact. The team must deliver the intelligence to both audiences. What is the most effective approach?

   • APublish the report on the internal wiki and let each team find what they need
   • BCreate two tailored reports: one with technical IOCs for the SOC and one with business impact for executives
   • CSend the same detailed technical report to both audiences
   • DSend the executive summary to the SOC and the technical report to executives
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has been experiencing an increase in ransomware attacks. The security team wants to use threat intelligence to improve its incident response capabilities. The team has a threat intelligence analyst and an incident responder. Which approach best uses threat intelligence to improve incident response?

   • AThe analyst provides the incident responder with up-to-date IOCs and TTPs related to ransomware, and the incident responder uses them to detect, contain, and eradicate the threat during an incident.
   • BThe analyst stores the intelligence in a database for future reference, and the incident responder only uses it after an incident is fully resolved.
   • CThe incident responder analyzes the intelligence to predict future attacks, and the analyst uses the predictions to update the firewall rules.
   • DThe analyst uses the intelligence to create a public report for customers, and the incident responder uses the report to update the company's website.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team has a threat intelligence analyst, a threat hunter, and an incident responder. The team receives a large volume of threat intelligence feeds, but the analyst is overwhelmed and cannot validate all the IOCs. The incident responder is seeing an increase in false positives because detection rules are based on unvalidated IOCs. The threat hunter is spending time validating IOCs instead of hunting. Which change best addresses the root cause of the problem?

   • AHave the threat hunter validate all IOCs before the analyst analyzes them.
   • BDisable all detection rules that use IOCs until the analyst can validate them.
   • CImplement a triage process where the analyst prioritizes IOCs based on relevance and credibility, and the detection engineer only uses validated IOCs in detection rules.
   • DIncrease the volume of threat intelligence feeds to provide more context.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a mature threat intelligence team, which role is primarily responsible for proactively searching through networks and endpoints to discover hidden threats that may have evaded existing security controls?

   • ASecurity operations center (SOC) monitor
   • BIncident responder
   • CThreat intelligence analyst
   • DThreat hunter
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is evaluating its threat intelligence program. The team has a threat intelligence analyst, a threat hunter, and an incident responder. The analyst produces weekly reports, but the hunter and incident responder rarely use them because the reports are too long and not actionable. The CISO wants to improve the usefulness of the intelligence. Which change best addresses the issue?

   • AThe analyst should produce longer reports with more technical details to ensure completeness.
   • BThe analyst should stop producing reports and only share raw intelligence feeds.
   • CThe hunter and incident responder should be required to read all reports, regardless of length.
   • DThe analyst should tailor reports to the needs of each role, providing concise, actionable intelligence with clear recommendations for the hunter and incident responder.
   Reveal Solution Discussion Select an answer first