Threat Intelligence Lifecycles and Maturity Models TIE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A threat intelligence team has a well-defined lifecycle process. After a major incident, the team conducts a post-incident review and finds that the intelligence they provided was not used by the incident responders because it was too technical and not actionable. The team wants to improve. Which action best demonstrates the iterative nature of the lifecycle?

   • AConduct a feedback session with incident responders to understand their needs and update the direction phase accordingly.
   • BIncrease the frequency of intelligence reports to keep responders informed.
   • CCreate a new report format that is more accessible to incident responders.
   • DBlame the incident responders for not understanding the intelligence.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   An organization assesses its threat intelligence capability and finds that it has no formal process, but individual analysts occasionally produce reports when an incident occurs. According to a typical maturity model, which level best describes this organization?

   • ALevel 2 – Managed
   • BLevel 4 – Optimized
   • CLevel 3 – Defined
   • DLevel 1 – Initial
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   A security team wants to improve its threat intelligence operations by ensuring that intelligence products are tailored to the needs of different consumer groups, such as executives, SOC analysts, and incident responders. Which lifecycle phase should the team focus on to achieve this?

   • ACollection
   • BDirection
   • CDissemination
   • DProcessing
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A large enterprise has a mature threat intelligence program at Level 3 (Managed/Measured) of a maturity model. The team produces high-quality reports, but the SOC is overwhelmed by the volume of alerts generated from the intelligence. The SOC manager suggests that the intelligence team should stop sharing IOCs and focus only on strategic reports. The intelligence team disagrees. Which approach best balances the need for operational intelligence with the SOC's capacity?

   • ADelegate the analysis of IOCs to the SOC so they can decide what to use.
   • BContinue sharing all IOCs but increase the frequency of reports to keep the SOC informed.
   • CStop sharing IOCs and only produce strategic reports to reduce alert fatigue.
   • DWork with the SOC to prioritize IOCs based on risk and relevance, and adjust the direction phase to focus on high-value threats.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A threat intelligence team has been producing a weekly report for a year. The report is well-received, but the team notices that the same types of incidents keep recurring. They want to use the lifecycle to break this cycle. Which action best leverages the iterative nature of the lifecycle?

   • ACollect more data from external sources to broaden coverage.
   • BUse feedback from incident reviews to update the direction phase, focusing on root causes rather than just indicators.
   • CIncrease the frequency of the report to twice a week to catch incidents earlier.
   • DChange the report format to include more visualizations.
   Reveal Solution Discussion Select an answer first