Use Cases for Different Types of Threat Intelligence TIE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A security operations center (SOC) is actively investigating a phishing campaign that is currently targeting employees. The SOC needs real-time information about the campaign's infrastructure to contain the threat. Which type of threat intelligence is most appropriate for this immediate incident response?

   • ATactical threat intelligence
   • BOperational threat intelligence
   • CTechnical threat intelligence
   • DStrategic threat intelligence
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During an active ransomware incident, the incident response team needs to understand the attacker's current infrastructure, including command-and-control (C2) servers and the specific malware variant, to contain the threat. Which type of threat intelligence should the team rely on?

   • ATechnical threat intelligence, which lists known ransomware IoCs
   • BOperational threat intelligence, which provides real-time details about the ongoing attack
   • CTactical threat intelligence, which describes the general TTPs of ransomware groups
   • DStrategic threat intelligence, which explains the business impact of ransomware
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is developing a threat intelligence program. They have limited staff and need to decide whether to focus on producing strategic reports for management or tactical playbooks for the SOC. The SOC is currently reactive and often misses early signs of attacks. The management team is asking for more visibility into cyber risks. Which focus is more appropriate given the constraints?

   • AFocus on strategic reports, because management needs visibility into risks.
   • BFocus on tactical playbooks, because they directly improve the SOC's ability to detect and respond to threats, addressing the reactive issue.
   • CSplit efforts equally between strategic and tactical, because both are equally important.
   • DFocus on technical intelligence, because it is the easiest to produce.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team is deciding which threat intelligence to purchase. They need to support both a quarterly executive risk report and daily threat hunting activities. Which combination of intelligence types should they prioritize?

   • ATactical and technical threat intelligence
   • BStrategic and operational threat intelligence
   • CStrategic and tactical threat intelligence
   • DOperational and technical threat intelligence
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A cybersecurity team is investigating a series of breaches in the retail sector. They notice that the attackers consistently use spear-phishing emails with malicious Excel macros, then escalate privileges via a specific Windows vulnerability, and finally exfiltrate data via encrypted FTP. The team wants to proactively hunt for similar activity in their own environment. Which type of threat intelligence should they use to guide their hunting?

   • ATactical threat intelligence, which describes the TTPs and patterns of the threat actor
   • BOperational threat intelligence, which provides details of past incidents in the retail sector
   • CStrategic threat intelligence, which explains the motivations of the threat actor
   • DTechnical threat intelligence, which lists the specific malware hashes used in the attacks
   Reveal Solution Discussion Select an answer first