Use Cases for Different Types of Threat Intelligence TIE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security manager is evaluating the effectiveness of their threat intelligence program. They notice that the SOC is using tactical intelligence to create detection rules, the incident response team is using operational intelligence to handle ongoing incidents, and the board is receiving strategic intelligence for risk decisions. However, the program is not meeting expectations because the SOC's detection rules are not catching new threats. What is the most likely gap in the program?

   • AThe board is not receiving tactical intelligence to understand the threats
   • BThe incident response team is not using strategic intelligence to guide their response
   • CThe SOC is not using technical intelligence to supplement the tactical intelligence with IoCs
   • DThe SOC is using too much technical intelligence and not enough tactical intelligence
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which statement correctly differentiates the time horizon and purpose of strategic versus operational threat intelligence?

   • AStrategic intelligence supports long-term planning; operational intelligence supports immediate incident response.
   • BStrategic intelligence is used for immediate incident response; operational intelligence is used for long-term planning.
   • CBoth strategic and operational intelligence are used for immediate incident response.
   • DBoth strategic and operational intelligence are used for long-term planning.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A regional bank's board of directors is deciding whether to invest in a new fraud-detection platform. They need to understand the long-term risk landscape for the banking sector, including emerging attack trends and regulatory changes. Which type of threat intelligence should the bank's security team present to the board?

   • ATactical threat intelligence, detailing specific malware families used in recent banking attacks
   • BStrategic threat intelligence, summarizing high-level threat trends and their potential business impact
   • COperational threat intelligence, describing ongoing phishing campaigns against the bank
   • DTechnical threat intelligence, listing IoCs from recent fraud attempts
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is integrating threat intelligence into their SIEM. They have a limited number of SIEM rules and need to prioritize which IoCs to ingest. They have a feed of 10,000 IPs, 5,000 domains, and 2,000 file hashes. The team wants to maximize detection of known malware while minimizing false positives. Which approach is best?

   • AIngest all IoCs equally, because more data always improves detection.
   • BPrioritize file hashes, because they are more specific and less likely to cause false positives than IPs or domains.
   • CPrioritize IPs, because they are the most numerous and likely to catch more threats.
   • DPrioritize domains, because they are more stable than IPs.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A multinational corporation is deciding whether to invest in a new security information and event management (SIEM) platform and expand its security team over the next three years. Which type of threat intelligence would most directly support this long-term investment decision?

   • AStrategic threat intelligence
   • BOperational threat intelligence
   • CTactical threat intelligence
   • DTechnical threat intelligence
   Reveal Solution Discussion Select an answer first