Identify the Common Tiers of Threat Intelligence and How They Might Be Applied to Threat Analysis. SPLK-5001 Practice Questions (Page 3)

Questions 11–15

1. 11application · easy

   A new analyst is joining the threat intelligence team and needs to understand the different tiers. The team lead explains that one tier is used for long-term strategic planning, another for immediate detection, and a third for understanding specific campaigns. Which of the following correctly matches the tiers to their primary purposes?

   • ATactical for planning, operational for detection, strategic for campaigns
   • BStrategic for planning, tactical for detection, operational for campaigns
   • CStrategic for detection, tactical for planning, operational for campaigns
   • DOperational for planning, strategic for detection, tactical for campaigns
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which tier of threat intelligence is most directly used to create detection rules for a specific malware family?

   • ATactical
   • BStrategic
   • CNone of the tiers are useful for detection
   • DOperational
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations center (SOC) analyst needs to update the SIEM correlation rules to detect a newly discovered malware family. The threat intelligence feed provides file hashes, domain names, and IP addresses associated with the malware's command-and-control infrastructure. Which tier of threat intelligence is the analyst applying?

   • AOperational
   • BExecutive
   • CStrategic
   • DTactical
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How does operational threat intelligence support proactive threat hunting?

   • ABy summarizing the threat landscape for senior management
   • BBy providing knowledge of actor behaviors and campaign patterns to guide search hypotheses
   • CBy providing automated alerts for every new vulnerability
   • DBy offering a list of known-bad domains to block
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security manager is developing a threat intelligence program and must decide how to allocate resources. The organization has a high risk of targeted attacks from a specific APT group. The manager wants to proactively hunt for this group's activities and also provide the board with a clear picture of the risk. Which allocation of resources is most effective?

   • AFocus solely on tactical intelligence to detect the APT's IOCs
   • BFocus solely on strategic intelligence to understand the APT's motivations
   • CFocus on tactical intelligence to detect the APT's IOCs, and use external reports for the board
   • DFocus on operational intelligence to understand the APT's TTPs and campaigns, and use strategic intelligence for the board
   Reveal Solution Discussion Select an answer first