Threat Intelligence Lifecycles and Maturity Models TIE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization's threat intelligence team has a formal process for collecting requirements, uses a commercial feed, and produces tailored reports for different audiences. However, they do not have a formal feedback mechanism to measure whether the intelligence is actually used or effective. According to common maturity models, which level best describes this team?

   • ALevel 2 - Defined/Repeatable
   • BLevel 3 - Managed/Measured
   • CLevel 1 - Initial/Ad hoc
   • DLevel 4 - Optimized
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An organization's threat intelligence team is at Level 2 (Defined) of a maturity model. They have formal processes but do not measure effectiveness. The team is considering two initiatives: (A) implementing a TIP to automate workflows, and (B) establishing metrics to track the impact of intelligence. The budget only allows one initiative. Which initiative should the team choose to advance to the next maturity level?

   • AInitiative A, because automation will improve efficiency and reduce manual effort.
   • BBoth initiatives, because they are equally important for maturity.
   • CNeither initiative, because the team should focus on expanding collection sources.
   • DInitiative B, because measurement is the defining characteristic of the next maturity level.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the threat intelligence lifecycle, which phase involves transforming raw collected data into a structured, machine-readable format that can be analyzed?

   • AAnalysis
   • BCollection
   • CProcessing
   • DFeedback
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A mid-sized company has a threat intelligence team that manually curates a list of indicators of compromise (IOCs) from a few free feeds and shares them via email. They have no formal process for collecting requirements from stakeholders, and they do not measure the effectiveness of their intelligence. According to common threat intelligence maturity models, which capability gap is most critical for this team to address first?

   • AEstablishing a formal requirements-gathering process with stakeholders.
   • BAutomating the collection of IOCs from commercial feeds.
   • CIncreasing the frequency of email reports to stakeholders.
   • DInvesting in a commercial threat intelligence platform (TIP) to store IOCs.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A threat intelligence team publishes a weekly report on ransomware trends. After two weeks, the incident response team complains that the report lacks actionable indicators for their specific environment. According to the intelligence lifecycle, what should the team do next?

   • AMove directly to dissemination and distribute the report through a different channel.
   • BSkip the processing phase to deliver raw data faster to the incident response team.
   • CInitiate a feedback loop to revise the direction phase based on the incident response team's needs.
   • DCollect more raw data from additional external feeds before the next report.
   Reveal Solution Discussion Select an answer first