Threat Intelligence Roles, Responsibilities, and Use Cases TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A financial services company is evaluating its cybersecurity posture. The CISO wants to use threat intelligence to support risk management decisions, specifically to prioritize investments in security controls. The company has a threat intelligence team that produces reports on emerging threats. Which use of threat intelligence would best support the CISO's risk management objective?

   • AShare raw intelligence feeds with all employees so they can make their own security decisions.
   • BAutomatically block all IP addresses listed in the intelligence feeds, regardless of context, to reduce the attack surface.
   • CUse the intelligence to create a list of all possible threats and invest equally in controls for each threat.
   • DProvide the CISO with intelligence summaries that highlight the likelihood and potential impact of specific threats relevant to the company's business, so that controls can be prioritized accordingly.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is implementing a threat intelligence program. The team has a threat intelligence analyst, a threat hunter, and an incident responder. The CISO wants to ensure that the program supports the organization's overall security strategy, including detection, response, and risk management. Which approach best ensures that all three roles contribute to the strategy?

   • AEstablish a regular meeting where the analyst shares intelligence with the hunter and responder, and the hunter and responder provide feedback on the usefulness of the intelligence.
   • BHave the CISO make all decisions without input from the team.
   • CHave the analyst work in isolation and only share reports with the CISO.
   • DHave the hunter and responder work independently without sharing information with the analyst.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A threat intelligence team has finished analyzing a new malware campaign targeting their industry. The team must now ensure that the indicators of compromise (IOCs) are formatted and delivered to the security operations center (SOC) and the incident response team so they can update detection rules and prepare response playbooks. Which responsibility is the team fulfilling?

   • AAction
   • BDissemination
   • CCollection
   • DAnalysis
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   During a major incident, the incident response team is overwhelmed with alerts and requests for information. The threat intelligence team has produced a detailed report on the attacker's TTPs, but the IR team does not have time to read it. The IR lead asks the intelligence team to provide a concise summary of the most critical actions to take. Which responsibility should the intelligence team fulfill to best support the IR team?

   • AConduct additional collection to gather more data
   • BWait for the IR team to request the full report
   • CPerform deeper analysis to produce a longer report
   • DTailor the dissemination of intelligence to the consumer's needs
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is considering using threat intelligence to support both threat detection and risk management. The security team has limited resources and must choose between investing in a threat intelligence platform (TIP) or hiring additional analysts. The CISO wants to improve both detection and risk management. Which approach best balances the trade-off?

   • AHire additional analysts to manually process all threat intelligence feeds, without investing in automation.
   • BUse only free threat intelligence feeds and do not invest in any tools or personnel.
   • CInvest in a TIP that automates the collection and correlation of threat intelligence, allowing existing analysts to focus on analysis and dissemination, which supports both detection and risk management.
   • DFocus all resources on threat detection and ignore risk management for now.
   Reveal Solution Discussion Select an answer first