Threat Intelligence Lifecycles and Maturity Models TIE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In the CERT-UK (now NCSC-UK) threat intelligence maturity model, which level is characterized by an organization having a defined and documented threat intelligence process that is consistently followed?

   • ALevel 3 – Defined
   • BLevel 4 – Quantitatively Managed
   • CLevel 1 – Initial
   • DLevel 2 – Managed
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company's threat intelligence team has a formal process for collecting requirements, uses multiple commercial and open-source feeds, and produces tailored reports for different teams. They also track metrics such as the number of IOCs consumed by the SOC and the time from collection to dissemination. According to common maturity models, which level best describes this team?

   • ALevel 4 - Optimized
   • BLevel 1 - Initial/Ad hoc
   • CLevel 3 - Managed/Measured
   • DLevel 2 - Defined/Repeatable
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   When assessing an organization's threat intelligence maturity, which of the following is a key indicator that the organization has reached a higher maturity level?

   • AThe organization has a documented process for defining intelligence requirements and measuring the value of intelligence products
   • BThe organization relies on a single senior analyst to produce all intelligence reports
   • CThe organization shares intelligence internally only after a security incident occurs
   • DThe organization only collects threat data from open-source feeds
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A threat intelligence analyst is documenting the lifecycle of a specific intelligence product. The analyst has just finished converting raw data into a structured format and has enriched it with context. According to the lifecycle, which phase has the analyst just completed?

   • ADissemination – because the analyst shared the enriched data with others.
   • BAnalysis – because the data was interpreted and given meaning.
   • CProcessing – because raw data was transformed into a usable and enriched format.
   • DCollection – because the analyst gathered the raw data.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is assessing its threat intelligence maturity. The team has a formal requirements process, uses multiple sources, and produces tailored reports. However, they do not track metrics, and there is no formal feedback loop from consumers. The company has a limited budget and must choose one improvement to move to the next maturity level. Which improvement should they choose?

   • AInvest in a commercial threat intelligence platform (TIP) to automate collection and analysis.
   • BExpand the number of open-source feeds to improve coverage.
   • CEstablish a formal feedback mechanism and define metrics to measure intelligence effectiveness.
   • DHire additional analysts to increase the volume of intelligence produced.
   Reveal Solution Discussion Select an answer first