Direction and Review of the Threat Intelligence Program CTIA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A utility company's threat intelligence program review shows that the program is effective at producing strategic intelligence for executives but is failing to support the operational technology (OT) team, which needs real-time indicators to protect industrial control systems. The program manager must improve the program. Which action is most appropriate?

   • AAsk the OT team to use the existing strategic reports and extract the relevant indicators themselves
   • BReduce the frequency of strategic reports to free up resources for the OT team
   • CAdd OT-specific intelligence requirements and establish a separate operational intelligence feed with faster delivery mechanisms
   • DReplace the strategic intelligence program with an operational intelligence program focused solely on OT
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A threat intelligence team has been producing weekly reports for six months. The CISO wants to evaluate whether the program is meeting its objectives. The team has been tracking the number of reports produced and the number of indicators shared with the SOC. The CISO asks you to recommend a better set of metrics. Which approach best addresses the need?

   • AAsk stakeholders to provide qualitative feedback on the reports and use that as the sole basis for evaluation.
   • BAdd metrics that measure the consumption and application of intelligence, such as the percentage of reports read by stakeholders and the number of detections created from intelligence.
   • CContinue tracking the number of reports and indicators, as these are the standard metrics for a threat intelligence program.
   • DReplace all current metrics with a single metric: the number of security incidents prevented by the intelligence program.
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   A threat intelligence program's annual review shows that the program is meeting its KPIs for timeliness and relevance, but stakeholder satisfaction is declining. A survey reveals that stakeholders feel the intelligence is too technical and not actionable for their roles. The program manager must decide how to improve the program. Which action best addresses the root cause?

   • AReduce the number of stakeholders served to focus on those who appreciate the current format.
   • BProvide training to stakeholders to help them understand technical intelligence.
   • CTailor intelligence products to different audience levels, providing executive summaries and actionable recommendations for non-technical stakeholders.
   • DIncrease the frequency of intelligence reports to keep stakeholders more informed.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary role of key performance indicators (KPIs) in the review process of a threat intelligence program?

   • ATo ensure all threat intelligence data is stored in a centralized repository.
   • BTo replace the need for regular program reviews by providing automated reports.
   • CTo determine the exact number of threat intelligence analysts required for the program.
   • DTo measure the program's effectiveness and efficiency against defined objectives.
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A multinational corporation is reviewing its threat intelligence program. The program currently serves the security operations center (SOC), incident response (IR), and executive leadership. The review team includes the CISO, the SOC manager, and the IR lead. The CISO wants to ensure that the program's direction is aligned with the company's strategic objective of entering a new market in a region with high geopolitical risk. Which stakeholder should be added to the review team to best inform the program's direction?

   • AThe chief financial officer (CFO) to assess the financial impact of geopolitical risks.
   • BThe chief information officer (CIO) to ensure IT infrastructure supports the expansion.
   • CThe regional director for the new market to provide on-the-ground risk context.
   • DThe head of corporate communications to manage public perception.
   Reveal Solution Discussion Select an answer first