Identify the Common Tiers of Threat Intelligence and How They Might Be Applied to Threat Analysis. SPLK-5001 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which activity most directly relies on tactical threat intelligence?

   • ADeciding whether to increase the security budget for the next fiscal year
   • BPresenting an annual threat landscape report to the board
   • CCreating a SIEM correlation rule to alert on a known malicious file hash
   • DInterviewing a threat actor to understand their motives
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   A large organization has a mature security program. The SOC uses tactical intelligence for detection, and the incident response team uses operational intelligence for investigations. The CISO now wants to align the security program with the organization's business goals and risk appetite. Which tier of threat intelligence should the CISO incorporate to achieve this?

   • AA combination of tactical and operational intelligence, as they are more actionable
   • BTactical intelligence, to enhance the SOC's detection capabilities
   • CStrategic intelligence, to inform risk management and business alignment
   • DOperational intelligence, to improve incident response
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is responding to a ransomware incident. The SOC has identified the ransomware family and its IOCs. The incident response team needs to understand the attacker's negotiation tactics and whether they are likely to leak data. The executive team needs a summary of the potential business impact. Which combination of threat intelligence tiers is most appropriate?

   • ATactical for the SOC, operational for the IR team, and strategic for the executives
   • BStrategic for the SOC, tactical for the IR team, and operational for the executives
   • COperational for the SOC, strategic for the IR team, and tactical for the executives
   • DTactical for all teams, as it is the most actionable
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of categorizing threat intelligence into tiers?

   • ATo rank intelligence sources by their reliability and trustworthiness
   • BTo match the intelligence detail and audience with the appropriate analysis and decision-making need
   • CTo separate intelligence that is actionable from intelligence that is not
   • DTo determine which intelligence feeds should be purchased or subscribed to
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary focus of tactical threat intelligence?

   • AIndicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs)
   • BThe motivations and goals of a specific threat actor
   • CHigh-level trends in cybercrime affecting the industry
   • DExecutive summaries of security incidents
   Reveal Solution Discussion Select an answer first