A security team is building a threat intelligence program. They have limited resources and need to prioritize their efforts. The team's primary goal is to improve detection of known threats and reduce the time to respond to incidents. They also want to inform the board about the organization's risk posture. Which approach best balances these needs?

Focus exclusively on strategic intelligence to inform the board, and rely on vendor alerts for detection

Focus exclusively on tactical intelligence to improve detection, and rely on external reports for the board

Implement all three tiers equally from the start, without prioritization

Prioritize tactical intelligence for detection, and use strategic intelligence for board reporting, with operational intelligence as a secondary support

Which three tiers are commonly used to categorize threat intelligence?

Technical, managerial, and executive

Internal, external, and third-party

Reactive, proactive, and predictive

Strategic, tactical, and operational

A security manager is presenting to the C-suite to justify an increase in the security budget. The presentation needs to highlight the long-term threat landscape, the organization's exposure, and the potential financial impact of a breach. Which type of threat intelligence should the manager use?

A mix of all tiers, with equal emphasis

Tactical intelligence, such as recent malware signatures

Operational intelligence, such as details of a specific campaign

Strategic intelligence, such as industry threat trends and risk assessments

Which statement best describes strategic threat intelligence?

Real-time alerts about active attacks in the organization's environment

Detailed indicators of compromise used to detect specific malware

Technical reports on the tools and infrastructure used by a specific threat actor

High-level, long-term information used by executives to inform risk decisions

A security architect is designing a new security program and needs to define the organization's risk appetite and long-term security strategy. The architect needs intelligence that provides a broad view of the threat landscape, including geopolitical trends and industry-specific risks. Which tier of threat intelligence is most appropriate?

A combination of tactical and operational

SplunkCertified Cybersecurity Defense Analyst

Domain 2Objective 3

Identify the Common Tiers of Threat Intelligence and How They Might Be Applied to Threat Analysis. SPLK-5001 Practice Questions (Page 4)

Part of the Threat and Attack Types, Motivations, and Tactics domain, which accounts for 20% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

5concepts

20%of the exam

Questions 16–20

16expert · hard
A security team is building a threat intelligence program. They have limited resources and need to prioritize their efforts. The team's primary goal is to improve detection of known threats and reduce the time to respond to incidents. They also want to inform the board about the organization's risk posture. Which approach best balances these needs?
Select an answer first
17foundation · easy
Which three tiers are commonly used to categorize threat intelligence?
Select an answer first
18application · medium
A security manager is presenting to the C-suite to justify an increase in the security budget. The presentation needs to highlight the long-term threat landscape, the organization's exposure, and the potential financial impact of a breach. Which type of threat intelligence should the manager use?
Select an answer first
19foundation · easy
Which statement best describes strategic threat intelligence?
Select an answer first
20application · medium
A security architect is designing a new security program and needs to define the organization's risk appetite and long-term security strategy. The architect needs intelligence that provides a broad view of the threat landscape, including geopolitical trends and industry-specific risks. Which tier of threat intelligence is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.

Identify the Common Tiers of Threat Intelligence and How They Might Be Applied to Threat Analysis. SPLK-5001 Practice Questions (Page 4)

Questions 16–20

Which three tiers are commonly used to categorize threat intelligence?

A security manager is presenting to the C-suite to justify an increase in the security budget. The presentation needs to highlight the long-term threat landscape, the organization's exposure, and the potential financial impact of a breach. Which type of threat intelligence should the manager use?

Which statement best describes strategic threat intelligence?

Keep studying — Threat and Attack Types, Motivations, and Tactics