Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Incident Response · Question Set
Threat Intel & Analysis interview questions for placements and exams.
Questions
13
Included in this set
Subject
Incident Response
Explore more sets
Difficulty
Mixed
Level of this set
Go through each question and its explanation. Use this set as a focused practice pack for Incident Response.
Tactics are the strategic goals in an attack chain, such as Lateral Movement or Privilege Escalation. Techniques explain the specific methods used to achieve those goals, like using RDP or token impersonation.
For complete preparation, combine this set with full subject-wise practice for Incident Response. You can also explore other subjects and sets from the links below.
The threat intelligence lifecycle consists of: 1. Planning and Direction – Define objectives and requirements. 2. Collection – Gather data from internal and external sources. 3. Processing – Clean and normalize the data for analysis. 4. Analysis – Identify patterns, correlate indicators and derive insight. 5. Dissemination – Share the findings with relevant teams. 6. Feedback – Evaluate usefulness and improve future cycles. Following this cycle keeps intelligence actionable and current.
Threat intelligence provides context that turns raw alerts into actionable insights. By knowing which adversary groups target their sector and what tools they use, teams can prioritize alerts, focus hunting efforts, and accelerate containment. It shortens detection time and reduces false positives through better contextual awareness.
The threat intelligence lifecycle begins with Planning and Direction — deciding what information is needed and how it will be used. This phase sets clear goals for collection, analysis, and sharing activities.
Threat intelligence comes from structured and unstructured sources such as OSINT, vendor feeds, government advisories, and internal logs. Payroll systems are business applications and do not generate intelligence data.
Threat intelligence is typically categorized as strategic (high-level trends), tactical (attack techniques and IOCs), and operational (real-time campaign insight). Financial data is business-related, not a TI type.
Sharing intelligence through platforms like ISACs and STIX/TAXII enables organizations to spot trends faster and collectively respond to emerging threats. Collaboration turns isolated defenses into community protection.
Data is raw facts — such as IP addresses or timestamps. Information is processed data that has context, for example a list of malicious IPs. Threat Intelligence goes further by adding analysis and relevance, explaining what the threat means, its intent, and how to act on it.
MITRE ATT&CK maps adversary tactics and techniques across the attack lifecycle. During IR, analysts use it to classify observed behaviors, understand attacker goals, and identify gaps in defenses. It also supports threat hunting and reporting with standardized terminology.
Key challenges include data sensitivity, privacy concerns, legal restrictions, and inconsistent formats across tools. Organizations fear exposing internal breaches or losing competitive advantage. Frameworks like STIX and TAXII standardize sharing while preserving security and context.
Threat Intelligence provides context about current or emerging cyber threats. It helps analysts understand attacker motives, methods, and tools so they can anticipate attacks, strengthen defenses, and respond faster during incidents.
IOCs are digital clues that indicate potential malicious activity. Examples include IP addresses, domain names, file hashes, or unusual processes. Analysts use them to detect, correlate, and block attacks before full compromise occurs.
In MITRE ATT&CK, 'tactics' describe the adversary’s objectives, such as Initial Access, Execution, or Persistence. They represent *why* an attacker performs an action, while 'techniques' describe *how* it’s done.