Threat Intelligence Lifecycles and Maturity Models TIE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An organization is evaluating its threat intelligence maturity using a model that includes levels from Initial to Optimizing. The organization has a centralized team that produces intelligence, but individual business units do not consistently use it. The team wants to increase the adoption of intelligence across the organization. Which maturity improvement is most likely to increase adoption?

   • AFocus on improving the processing phase to deliver data faster.
   • BIncrease the volume of intelligence produced to cover more topics.
   • CCentralize all intelligence decisions to ensure consistency.
   • DInvolve business units in the direction phase to ensure the intelligence meets their specific needs.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A threat intelligence team is assessing its maturity. They have a well-defined process for collection and analysis, but they struggle to measure the value of their intelligence to the business. They have tried tracking the number of indicators produced, but leadership does not find this meaningful. Which improvement would most effectively address the measurement gap?

   • ASwitch to a different threat intelligence platform to get better reporting features.
   • BIncrease the number of indicators produced to demonstrate higher productivity.
   • CDevelop outcome-based metrics, such as the reduction in incident response time or the number of prevented attacks.
   • DAsk the security team to provide anecdotal feedback on the usefulness of reports.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has a threat intelligence team that produces excellent reports, but the reports are not integrated into the security operations tools. The SOC manually checks the reports and creates indicators in the SIEM. This process is error-prone and slow. The team wants to improve the impact of their intelligence. Which approach best addresses the integration gap while maintaining the quality of the intelligence?

   • AStop producing reports and rely on the SOC to find indicators independently.
   • BAutomate the dissemination phase by integrating the intelligence platform with the SIEM to push indicators directly.
   • CReduce the number of indicators in the reports to make manual entry easier.
   • DAsk the SOC to manually enter the indicators more carefully.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security manager is assessing the maturity of the organization's threat intelligence capabilities. The team currently collects IOCs from a single open-source feed, has no formal requirements process, and shares intelligence only through an informal chat channel. The manager wants to move the team to a 'Defined' maturity level. What should be the first improvement to implement?

   • APurchase a commercial threat intelligence platform (TIP) to automate collection.
   • BStart sending daily emails to all employees with threat updates.
   • CHire more analysts to increase the volume of intelligence produced.
   • DDocument a formal intelligence requirements process and standard operating procedures.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A small company wants to improve its threat intelligence maturity without adding staff. They currently have no formal lifecycle and rely on the network admin to check a few blogs. Which first step best aligns with the lifecycle model and a realistic maturity improvement?

   • ABegin collecting as much data as possible from all available sources.
   • BPurchase a commercial threat intelligence platform to automate all phases.
   • CHire a dedicated threat intelligence analyst to manage the lifecycle.
   • DDefine a formal direction phase by documenting the organization's key intelligence requirements (KIRs).
   Reveal Solution Discussion Select an answer first