Use Cases for Different Types of Threat Intelligence TIE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is configuring a new intrusion detection system (IDS). They have a limited budget and must choose between purchasing a commercial IoC feed or a threat intelligence platform that provides TTPs and campaign analysis. The team's primary goal is to detect known malware and malicious domains. Which option should they choose?

   • ANeither, because IDS should rely on signature-based detection only
   • BThe threat intelligence platform, because it provides more comprehensive intelligence
   • CBoth, because they are complementary
   • DThe commercial IoC feed, because it provides the technical indicators needed for IDS detection
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team has a limited budget and must choose between two threat intelligence subscriptions. Subscription A provides detailed reports on threat actor motivations and industry trends, updated quarterly. Subscription B provides real-time feeds of malicious IPs and domains, updated every few minutes. The team's primary need is to reduce the time to detect and block known malicious infrastructure. Which subscription should they choose?

   • ANeither subscription, because threat intelligence feeds are not effective for blocking known infrastructure.
   • BSubscription A, because strategic intelligence provides context that helps prioritize detection efforts.
   • CBoth subscriptions, because combining strategic and technical intelligence is always better.
   • DSubscription B, because technical intelligence directly supports detection and blocking of known malicious infrastructure.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A chief information security officer (CISO) needs a high-level overview of emerging cyber threats to present to the board, while a SOC analyst needs specific indicators to block an ongoing attack. Which pair of threat intelligence types correctly matches these two needs?

   • AOperational for the CISO; strategic for the SOC analyst
   • BTactical for the CISO; operational for the SOC analyst
   • CTechnical for the CISO; tactical for the SOC analyst
   • DStrategic for the CISO; technical for the SOC analyst
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A government agency is planning its cybersecurity budget for the next five years. It needs to understand the long-term evolution of cyber threats targeting critical infrastructure, including the potential impact of nation-state actors. Which type of threat intelligence should the agency use for this planning?

   • ATechnical threat intelligence, which lists IoCs from recent attacks
   • BOperational threat intelligence, which describes current attacks on government networks
   • CStrategic threat intelligence, which provides long-term assessments of threat trends and risks
   • DTactical threat intelligence, which details the specific tools used by nation-state actors
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A security analyst is reviewing a report that details the specific tools, techniques, and procedures (TTPs) used by a known ransomware group. The analyst wants to use this information to improve detection rules. Which type of threat intelligence is being applied?

   • AOperational threat intelligence
   • BTechnical threat intelligence
   • CTactical threat intelligence
   • DStrategic threat intelligence
   Reveal Solution Discussion Select an answer first