Threat Intelligence Roles, Responsibilities, and Use Cases TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company has just experienced a data breach. The CEO wants to know who is responsible for leading the technical response to contain the breach, eradicate the threat, and recover affected systems. Which role should be assigned this responsibility?

   • ASecurity auditor
   • BThreat intelligence analyst
   • CThreat hunter
   • DIncident responder
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security operations center (SOC) receives a threat intelligence feed containing indicators of compromise (IOCs) for a new ransomware strain. The SOC team wants to use this feed to identify any infected hosts on their network. Which use case of threat intelligence is the SOC applying?

   • AIncident response
   • BRisk management
   • CThreat detection
   • DThreat hunting
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team has a threat intelligence analyst, a threat hunter, and an incident responder. The team is responding to a ransomware incident. The analyst has identified the ransomware family and its TTPs. The hunter has found evidence of lateral movement. The incident responder is working to contain the threat. Which action best coordinates the team's efforts to minimize the impact of the incident?

   • AThe hunter stops hunting and takes over incident response, while the analyst continues analysis.
   • BThe analyst shares the TTPs with the hunter and responder, the hunter provides the lateral movement findings to the responder, and the responder uses both to contain and eradicate the threat.
   • CThe analyst keeps the TTPs confidential, the hunter keeps the lateral movement findings confidential, and the responder works alone.
   • DThe responder waits for the analyst to finish a full report before taking any action.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team has a threat intelligence analyst, a threat hunter, and an incident responder. The team is implementing a new threat intelligence program. The CISO wants to ensure that the program supports both proactive threat hunting and reactive incident response. The team has limited budget for tools and training. Which approach best balances the need for both proactive and reactive capabilities?

   • APurchase a separate tool for threat hunting and a separate tool for incident response, without integration.
   • BUse only manual processes for both hunting and response, without any tools.
   • CInvest in a threat intelligence platform that integrates with the SIEM and provides automated alerting, while also providing the hunter with query capabilities for proactive hunting.
   • DFocus all budget on training the incident responder and ignore proactive hunting for now.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   During an incident response investigation, how can threat intelligence be most effectively used?

   • ATo replace the need for forensic analysis of the affected systems
   • BTo enrich indicators of compromise with context about the threat actor and their tactics
   • CTo automatically contain the incident without human intervention
   • DTo guarantee that the same threat actor will not attack again
   Reveal Solution Discussion Select an answer first