Use Cases for Different Types of Threat Intelligence TIE Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A manufacturing company's SOC receives an alert about a suspicious PowerShell command on a workstation in the finance department. The command attempts to download a file from a recently registered domain. The SOC analyst needs to determine if this is a known campaign or a new threat. Which type of threat intelligence should the analyst consult FIRST to provide immediate context for this alert?

   • AOperational threat intelligence, including details of past incidents in the same industry
   • BTechnical threat intelligence, such as a list of known malicious IP addresses and file hashes
   • CTactical threat intelligence, focusing on the threat actor's TTPs and recent campaign activity
   • DStrategic threat intelligence, such as reports on geopolitical risks affecting the manufacturing sector
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   During a major security incident, the incident response team is overwhelmed with alerts and needs to prioritize their actions. They have access to strategic intelligence about the threat actor's motivations, tactical intelligence about their TTPs, and technical intelligence with IoCs. Which intelligence type should the team use to prioritize which alerts to investigate first?

   • AStrategic intelligence, because it explains the attacker's motivations and likely targets
   • BTechnical intelligence, because it provides the IoCs to match against alerts
   • COperational intelligence, because it provides the current incident status
   • DTactical intelligence, because it helps identify which alerts match the attacker's known TTPs
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A large enterprise is deciding whether to invest in a new security information and event management (SIEM) platform. The CISO needs to justify the investment to the board by demonstrating the long-term reduction in cyber risk. The security team has access to technical threat intelligence feeds and strategic threat intelligence reports. Which intelligence should the CISO use to make the business case?

   • ATechnical threat intelligence, because it shows the number of IoCs blocked by the SIEM
   • BStrategic threat intelligence, because it provides the risk reduction and trend analysis needed for a business case
   • CNeither, because the decision should be based on cost alone
   • DBoth strategic and technical intelligence, because they together provide a complete picture
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A SOC is overwhelmed by alerts from a new campaign. The team has access to both tactical intelligence (TTPs) and technical intelligence (IoCs). The manager wants to reduce alert fatigue while ensuring that true positives are not missed. Which approach is most effective?

   • ADisable all alerting and rely on manual analysis of the campaign.
   • BUse only tactical intelligence to create rules, because technical intelligence is not useful for detection.
   • CUse only technical intelligence to block all IoCs, because that is the fastest way to reduce alerts.
   • DUse tactical intelligence to create behavioral detection rules that focus on the campaign's TTPs, and use technical intelligence to enrich alerts.
   Reveal Solution Discussion Select an answer first