Threat Intelligence Lifecycles and Maturity Models TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization's threat intelligence team has a documented process for collecting and processing threat data, and they consistently produce weekly reports. However, they have no formal mechanism to measure whether the intelligence reduces the impact of incidents. According to a maturity model, which capability is most lacking?

   • AQuantitative management – the ability to measure and control the effectiveness of intelligence operations.
   • BFeedback – the ability to incorporate consumer input into future cycles.
   • CCollection management – the ability to select and manage intelligence sources.
   • DDissemination – the ability to distribute reports to the right stakeholders.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An organization is at Level 3 (Defined) in a maturity model. They have standardized processes but do not yet use metrics to improve. Leadership wants to reach Level 5 (Optimizing) but is concerned about the cost and effort. Which recommendation best addresses the trade-off between maturity improvement and resource constraints?

   • AFirst implement quantitative management to establish a baseline, then use that data to identify incremental improvements.
   • BSkip Level 4 and directly implement innovative tools to achieve Level 5.
   • COutsource the entire threat intelligence function to a managed service provider.
   • DFocus only on improving the analysis phase and ignore other phases.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company's threat intelligence program currently relies on a single analyst who manually curates indicators from a few free feeds and shares them via email. There is no formal process for defining requirements or measuring the impact of the intelligence. According to common maturity models, which level best describes this program?

   • ALevel 3 – Defined, because the analyst uses standard industry feeds.
   • BLevel 1 – Initial/Ad hoc, because activities are informal, reactive, and dependent on individual effort.
   • CLevel 2 – Managed, because there is a repeatable process for collecting indicators.
   • DLevel 4 – Quantitatively Managed, because the analyst tracks the number of indicators shared.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A threat intelligence analyst is preparing a report for executive leadership about a new malware campaign. The analyst has already collected and processed the data. Which phase should the analyst perform next to ensure the report is meaningful and not just a list of indicators?

   • ADissemination – to send the report to the executives immediately.
   • BAnalysis – to interpret the data, identify patterns, and draw conclusions relevant to the organization.
   • CCollection – to gather more indicators to make the report longer.
   • DFeedback – to ask the executives what they think of the report before it is written.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which phase of the threat intelligence lifecycle involves defining the intelligence requirements and identifying the key questions that the intelligence effort must answer?

   • ADirection
   • BDissemination
   • CProcessing
   • DCollection
   Reveal Solution Discussion Select an answer first