Threat Intelligence Lifecycles and Maturity Models TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security operations center (SOC) analyst receives a request from the fraud team for indicators related to a new phishing campaign targeting their payment portal. The analyst immediately starts pulling IP addresses and domains from open-source feeds and pushes them to the firewall team. Which lifecycle phase did the analyst skip, and what is the most likely consequence?

   • ASkipped the dissemination phase; the firewall team will not know how to apply the indicators.
   • BSkipped the analysis phase; the firewall team will block legitimate traffic because the indicators were not enriched.
   • CSkipped the direction phase; the collected indicators may not align with the fraud team's actual intelligence requirements.
   • DSkipped the processing phase; the raw indicators will be unusable because they lack formatting.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A threat intelligence analyst is working on a request from the executive team about the risk of a specific threat actor. The analyst has collected a large amount of data, but the data is noisy and includes many false positives. The analyst is under time pressure to deliver a report. Which approach best balances the need for accuracy with the time constraint?

   • ADeliver the raw data to the executive team and let them interpret it.
   • BSkip the processing phase to save time and analyze the raw data directly.
   • CSpend more time collecting additional data to reduce false positives before analysis.
   • DPerform a focused analysis on the most relevant data sources and clearly state the confidence level in the report.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A mid-sized company wants to establish a threat intelligence capability but has limited budget and staff. They need to prioritize which lifecycle phases to implement first. Which approach best aligns with the lifecycle model and a realistic maturity path?

   • AFocus only on dissemination to ensure stakeholders receive regular reports.
   • BSkip direction and go straight to collection to start producing intelligence quickly.
   • CImplement all six phases simultaneously with a commercial platform to ensure full coverage.
   • DStart with direction and collection, using free and open-source feeds, and then gradually add processing and analysis.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which characteristic is typical of the lowest maturity level in most threat intelligence maturity models?

   • AIntelligence activities are performed in an ad-hoc and reactive manner
   • BIntelligence requirements are formally defined and reviewed
   • CIntelligence products are consistently disseminated to all stakeholders
   • DIntelligence processes are fully automated and integrated
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company has a mature threat intelligence program that produces high-quality reports. However, the SOC often ignores the reports because they are too long and not tailored to their operational needs. The intelligence team wants to improve the impact of their intelligence without reducing its quality. Which approach best balances the need for thorough analysis with the SOC's need for actionable information?

   • AReduce the length of all reports to one page to ensure they are read.
   • BSend the reports to the SOC only after they are approved by leadership.
   • CStop producing reports and instead share raw indicators directly with the SOC.
   • DCreate a tiered dissemination model: provide a short executive summary for leadership and a detailed technical annex for the SOC.
   Reveal Solution Discussion Select an answer first