The Threat Intelligence Generation Process TIE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A threat intelligence team has been producing weekly reports for a year. The team notices that the reports are rarely cited in incident response decisions, and stakeholders seem disengaged. The team suspects the reports are not aligned with the organization's priorities. What is the best way to realign the intelligence production with stakeholder needs?

   • AStop producing reports and focus only on ad-hoc requests.
   • BMake the reports more technical to attract the security team's attention.
   • CIncrease the frequency of reports to keep stakeholders more informed.
   • DConduct a formal feedback session with key stakeholders to understand their intelligence requirements and adjust the reporting format and content accordingly.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of collecting raw data from multiple sources during threat intelligence generation?

   • ATo eliminate the need for data processing and normalization
   • BTo provide a broad and diverse set of data points for more accurate analysis
   • CTo reduce the volume of data that needs to be processed
   • DTo ensure a single source of truth for all intelligence
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat intelligence team produces a weekly report on emerging malware campaigns for the executive board. After several weeks, the board members say the reports are too technical and do not help them make risk decisions. What should the team do to improve the intelligence product?

   • AStop producing the report because the board does not understand it.
   • BAdd more technical indicators and IoCs to the report so the board can share them with IT.
   • CSend the report only to the technical security team and exclude the board.
   • DTailor the report to the audience by focusing on business impact, risk levels, and recommended actions.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization collects threat data from multiple sources, including a SIEM, a threat feed, and a vulnerability scanner. The data contains duplicate entries, inconsistent timestamps, and missing fields. What is the primary goal of the data processing and normalization phase in this context?

   • ATo transform the data into a consistent format that can be analyzed and correlated effectively.
   • BTo store the data in its original format for legal compliance.
   • CTo encrypt the data so that only authorized analysts can view it.
   • DTo delete all data that is not immediately relevant to current threats.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A threat intelligence team has implemented a new reporting process. After three months, they want to evaluate whether the reports are meeting the needs of the stakeholders. What is the most effective way to gather this information?

   • AStop producing reports and see if anyone complains.
   • BCompare the reports to those produced by other organizations.
   • CConduct a structured feedback survey with the report consumers and track how often the reports lead to action.
   • DReview the reports internally and assume they are useful.
   Reveal Solution Discussion Select an answer first