Threat Intelligence Lifecycles and Maturity Models TIE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why is the threat intelligence lifecycle considered iterative rather than a one-time linear process?

   • ABecause the lifecycle must be repeated for each new threat actor that appears
   • BBecause the collection phase must be repeated until enough data is gathered
   • CBecause feedback from intelligence consumers is used to refine requirements and improve subsequent cycles
   • DBecause dissemination must occur multiple times to reach all stakeholders
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A threat intelligence team produces a weekly report for executives. After a major security incident, the executives complain that the report did not cover the threat actor involved. The team reviews the incident and realizes they had not collected data from a specific dark web forum where the actor was active. According to the threat intelligence lifecycle, what should the team do next?

   • AImmediately disseminate a new report about the threat actor to executives.
   • BUpdate the direction phase to include dark web monitoring and adjust collection sources accordingly.
   • CIncrease the frequency of collection from existing sources.
   • DBlame the lack of data on the dark web forum being inaccessible and move on.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat intelligence team has just delivered a report on a new exploit kit. The report was well-received, but the team noticed that the indicators were not directly useful to the SOC because they lacked context about the affected systems. What should the team do to improve the next cycle?

   • AChange the dissemination format to a more visual presentation.
   • BSkip the processing phase to deliver raw data faster.
   • CCollect more indicators from the same sources to ensure completeness.
   • DIncorporate the SOC's feedback into the next direction phase by adding system-specific context to the requirements.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   During the feedback phase of the threat intelligence lifecycle, what is the primary purpose of collecting input from intelligence consumers?

   • ATo evaluate the performance of the collection tools used
   • BTo determine whether the intelligence product was actionable and relevant to their needs
   • CTo identify new data sources for the collection phase
   • DTo archive the intelligence product for future reference
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization's threat intelligence program has standardized processes for collection, analysis, and dissemination, and these processes are documented and followed across the team. However, the program does not yet use metrics to improve its performance. According to a typical maturity model, what is the next level the organization should aim for?

   • AOptimizing – to focus on continuous process improvement through innovation.
   • BManaged – to establish project-level management and repeatable processes.
   • CQuantitatively Managed – to use statistical and other quantitative techniques to control processes.
   • DInitial – to restart the process with a clean slate.
   Reveal Solution Discussion Select an answer first