Identify the Common Tiers of Threat Intelligence and How They Might Be Applied to Threat Analysis. SPLK-5001 Practice Questions (Page 5)

Questions 21–22

1. 21expert · hard

   A threat intelligence analyst is reviewing a new report about a phishing campaign targeting the organization's industry. The report includes the phishing emails' subject lines, attachment names, and the infrastructure used. The analyst wants to create detection rules and also understand the campaign's scope. Which tier(s) of threat intelligence should the analyst use?

   • AOperational only, to understand the campaign
   • BTactical only, to create detection rules
   • CBoth tactical and operational intelligence
   • DStrategic only, as it provides the broadest view
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A threat intelligence analyst is tasked with producing a report that will be used by multiple teams: the SOC needs IOCs to update detection rules, the incident response team needs context on the threat actor's TTPs, and the executive team needs a summary of the overall risk. Which approach best meets all these needs?

   • AProduce a single report focused on strategic intelligence, as it covers all audiences
   • BProduce a single report that combines all tiers, but prioritize tactical intelligence
   • CProduce separate reports for each tier: strategic for executives, tactical for SOC, and operational for IR
   • DProduce a single report focused on tactical intelligence, as it provides IOCs and TTPs
   Reveal Solution Discussion Select an answer first