Threat Intelligence Lifecycles and Maturity Models TIE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A threat intelligence team is at Level 3 (Managed/Measured) of a maturity model. They have formal processes and track metrics, but they are struggling to demonstrate the value of intelligence to senior leadership. The leadership is considering cutting the team's budget. Which action best demonstrates the value of the intelligence program?

   • AShow the volume of IOCs collected and processed each month.
   • BEmphasize the cost of the commercial feeds used by the team.
   • CHighlight the number of reports produced and disseminated.
   • DPresent metrics that link intelligence to security outcomes, such as reduced time to detect or respond to incidents.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security leader is evaluating the maturity of the organization's threat intelligence program. The team has a documented process for requirements, collection, and analysis, but they do not have a formal way to measure the impact of their intelligence on security decisions. The leader wants to move the team to a 'Managed/Measured' level. What should the leader prioritize?

   • AHiring additional analysts to produce more reports.
   • BAdding more commercial threat intelligence feeds.
   • CImplementing metrics to track the consumption and effectiveness of intelligence products.
   • DAutomating the dissemination of reports via email.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An organization is at Level 2 (Managed) in a CMM-style maturity model. They have a repeatable process for producing threat intelligence, but it is project-specific and not standardized across the organization. The leadership wants to move to Level 4 (Quantitatively Managed) within a year. Which set of actions best addresses the maturity gap?

   • AHire more analysts to increase the volume of intelligence produced.
   • BAdopt a commercial threat intelligence platform to automate the entire lifecycle.
   • CImmediately implement a metrics dashboard to track intelligence production.
   • DStandardize the intelligence process across the organization, then define metrics to measure its effectiveness.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is assessing its threat intelligence maturity. They have a dedicated team, documented procedures, and they regularly collect feedback from consumers. However, they do not have a formal process for selecting and evaluating intelligence sources. Which maturity dimension is most likely to be rated lower?

   • AAnalysis – because the team lacks analytical frameworks.
   • BFeedback – because the team does not listen to consumers.
   • CCollection management – because there is no structured approach to source selection and validation.
   • DDissemination – because the team does not share reports effectively.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A regional bank has a mature threat intelligence program that produces daily reports for its SOC. The SOC analysts have started ignoring the reports because they contain too much generic malware data and not enough actionable information about banking Trojans. The intelligence team decides to redesign the program. Which action best aligns with the iterative nature of the intelligence lifecycle?

   • AMove directly to the dissemination phase and send reports more frequently to keep analysts engaged.
   • BSkip the processing phase to deliver raw intelligence faster to the SOC.
   • CCollect more raw data from additional open-source feeds to ensure nothing is missed.
   • DAdjust the direction phase to focus collection on banking Trojans and seek feedback from SOC analysts on report usefulness.
   Reveal Solution Discussion Select an answer first