Use Cases for Different Types of Threat Intelligence TIE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is investigating a breach that occurred three months ago. They have logs but no IoCs from the time of the breach. They need to determine if the attacker used a known TTP that was documented after the breach. Which type of threat intelligence would be most useful?

   • ATechnical threat intelligence, because it provides IoCs that can be matched against logs.
   • BOperational threat intelligence, because it provides information about current campaigns.
   • CTactical threat intelligence, because it provides TTPs that can be used to search historical logs for behavioral patterns.
   • DStrategic threat intelligence, because it provides high-level context about the threat actor.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A CISO must present a cybersecurity budget proposal to the board. The board is concerned about the rising number of ransomware attacks in the industry. The CISO needs to justify funding for both new detection tools and employee training. Which type of threat intelligence should be used to support this proposal?

   • AStrategic threat intelligence, because it provides the high-level risk analysis and industry trends needed to justify budget allocation.
   • BOperational threat intelligence, because it shows the current attack campaigns.
   • CTechnical threat intelligence, because it lists the IoCs of ransomware.
   • DTactical threat intelligence, because it details the specific TTPs used in ransomware attacks.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is investigating a series of intrusions that all used a novel phishing technique. The team has collected IoCs from the incidents, but the IoCs are not matching any known threat actor. The team needs to understand the attack pattern to develop a proactive defense. Which type of threat intelligence should the team prioritize?

   • AStrategic threat intelligence, to understand the geopolitical context
   • BTactical threat intelligence, to identify the TTPs and patterns across the intrusions
   • COperational threat intelligence, to coordinate with other incident responders
   • DTechnical threat intelligence, to expand the list of IoCs
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst at a healthcare organization is configuring the endpoint detection and response (EDR) tool to block known malicious files and domains. The analyst has access to a feed of hashes, IPs, and domain names from a commercial threat intelligence provider. Which type of threat intelligence is the analyst applying?

   • AStrategic threat intelligence, because the feed helps prioritize security investments
   • BOperational threat intelligence, because the feed is used during incident response
   • CTechnical threat intelligence, because the feed contains IoCs that can be directly matched and blocked
   • DTactical threat intelligence, because the feed includes information about attacker TTPs
   Reveal Solution Discussion Select an answer first
6. 15expert · hard · select all that apply

   A security team is building a threat intelligence program for a mid-sized company. They need to support multiple functions: executive reporting, SOC detection, incident response, and malware analysis. Select all the correct pairings of intelligence type and use case.

   • AStrategic intelligence for executive risk reporting
   • BTechnical intelligence for board investment decisions
   • CStrategic intelligence for SIEM alert tuning
   • DTactical intelligence for SOC detection rule creation
   • ETechnical intelligence for malware analysis
   • FOperational intelligence for incident response
   Check answers Discussion Select an answer first