Use Cases for Different Types of Threat Intelligence TIE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational corporation is establishing a threat intelligence program. The CISO wants a quarterly report on the global threat landscape for the board, the SOC manager wants daily feeds of IoCs for the SIEM, and the incident response team wants detailed TTPs for handling ongoing incidents. The budget is limited, so the program must prioritize the most impactful intelligence for each need. Which combination of intelligence types should the program focus on?

   • ATactical for the board, strategic for the SIEM, and operational for incident response
   • BTechnical for the board, tactical for the SIEM, and strategic for incident response
   • CStrategic for the board, technical for the SIEM, and tactical for incident response
   • DOperational for the board, technical for the SIEM, and strategic for incident response
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security manager is creating a threat intelligence program and must decide which type of intelligence to share with different audiences. The CISO needs a high-level overview of emerging threats for the annual report, while the SOC analysts need detailed TTPs to improve detection rules. Which approach correctly aligns the intelligence types with the audiences?

   • AProvide operational intelligence to both the CISO and the SOC analysts
   • BProvide strategic intelligence to the CISO and tactical intelligence to the SOC analysts
   • CProvide technical intelligence to the CISO and operational intelligence to the SOC analysts
   • DProvide tactical intelligence to the CISO and strategic intelligence to the SOC analysts
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization needs to produce a monthly report for the board on the overall threat landscape and a daily feed for the SOC to block malicious IPs. Which two types of threat intelligence should they use?

   • AStrategic and technical threat intelligence
   • BTactical and operational threat intelligence
   • COperational and technical threat intelligence
   • DStrategic and tactical threat intelligence
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A security analyst is configuring an intrusion detection system (IDS) to block traffic from known malicious IP addresses and domains. Which type of threat intelligence is most directly used for this task?

   • ATechnical threat intelligence
   • BTactical threat intelligence
   • CStrategic threat intelligence
   • DOperational threat intelligence
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A financial services firm is considering entering a new market in a region with emerging cyber threats. The board needs to understand the potential risks and the required security investments. The security team has access to strategic reports on regional threat trends, tactical reports on specific attack campaigns, and technical feeds of IoCs. Which intelligence should the team present to the board to support the market entry decision?

   • AA combination of tactical and technical intelligence, because they are more actionable
   • BStrategic reports, because they provide the high-level risk assessment needed for investment decisions
   • CTechnical feeds, because they provide the IoCs needed to secure the new market
   • DTactical reports, because they detail the specific attack methods used in the region
   Reveal Solution Discussion Select an answer first