Direction and Review of the Threat Intelligence Program CTIA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational corporation is establishing a threat intelligence program. The program will serve stakeholders in different regions with varying regulatory requirements and threat landscapes. The program manager must design the stakeholder engagement process. Which approach best ensures that regional needs are incorporated while maintaining a coherent global program?

   • AFocus only on the region with the highest threat level and ignore others
   • BEstablish a global steering committee with regional representatives who provide input on local requirements and receive tailored intelligence products
   • CCreate a single global intelligence product that is identical for all regions to ensure consistency
   • DAllow each region to run its own independent threat intelligence program without global coordination
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   A global logistics company has a mature threat intelligence program. The program's mission is to support the company's goal of expanding into new international markets. The CISO is reviewing the program's direction and finds that the intelligence requirements are heavily focused on cyber threats to IT systems, but the company's expansion involves significant physical supply chain risks. The CISO must decide how to adjust the program's direction. Which action best aligns the program with the company's strategic goal?

   • AExpand the program's scope to include physical supply chain threat intelligence and integrate it with cyber threat intelligence.
   • BKeep the current focus on cyber threats because physical risks are handled by the corporate security department.
   • CCreate a separate threat intelligence program for physical risks.
   • DShift the program's focus entirely to physical supply chain risks, as they are more relevant to expansion.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A large enterprise is forming a threat intelligence steering committee to oversee the program. The committee will include representatives from IT security, legal, and business units. What is the primary role of the business unit representatives on this committee?

   • ATo conduct the technical analysis of threat data and produce intelligence reports
   • BTo ensure that the intelligence program addresses the risks that matter to the organization's business objectives
   • CTo manage the day-to-day operations of the threat intelligence platform
   • DTo approve all technical intelligence reports before they are distributed
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A technology company is establishing a threat intelligence program. The program will serve multiple internal teams, including security operations, incident response, and product security. The CISO wants to ensure that the program's direction is aligned with the needs of all these teams. Which approach best ensures stakeholder alignment?

   • AFocus the program on the needs of the security operations team, as they are the primary consumer.
   • BConduct a stakeholder analysis to identify each team's intelligence requirements and incorporate them into the program's direction.
   • CHave the CISO define the program's direction based on their own understanding of the teams' needs.
   • DWait until the program is operational and then adjust based on feedback.
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A threat intelligence program serves a large enterprise with multiple business units. The program's KPIs include the number of intelligence reports delivered, the number of IOCs shared, and the number of briefings conducted. A review reveals that while these KPIs are met, business unit leaders report that the intelligence is not useful for their specific risk decisions. The CISO asks you to revise the KPIs to better measure value. Which KPI set best addresses the issue?

   • ANumber of analysts trained, number of tools deployed, and number of sources monitored.
   • BNumber of reports delivered, number of IOCs shared, and number of briefings conducted.
   • CTime to produce reports, number of reports updated, and number of follow-up questions from business units.
   • DPercentage of business units that report intelligence influenced a decision, and number of risk decisions informed by intelligence.
   Reveal Solution Discussion Select an answer first