Direction and Review of the Threat Intelligence Program CTIA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A retail company is defining the strategic direction of its threat intelligence program. The company's main concern is protecting customer payment data and maintaining customer trust. The CISO wants the program's goals to be measurable and aligned with this concern. Which goal best meets this requirement?

   • AIncrease the amount of threat data collected from various sources.
   • BReduce the number of payment card data breaches by 20% within the next year.
   • CImprove the skills of the threat intelligence analysts.
   • DEnhance the company's reputation in the market.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A mid-sized company's threat intelligence program review reveals that the program spends 70% of its time collecting data from open sources, but only 20% of the collected data is ever used in finished intelligence products. The program manager wants to improve efficiency. Which action should the program manager take?

   • AAutomate the production of finished intelligence reports to save time
   • BReduce the number of stakeholders to lower the demand for intelligence products
   • CRefine the intelligence requirements and collection plan to focus on sources that directly address those requirements
   • DIncrease the number of open sources monitored to ensure broader coverage
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which action best exemplifies continuous improvement in a threat intelligence program?

   • APurchasing a new threat intelligence platform every year regardless of need.
   • BConducting annual reviews and implementing a prioritized action plan based on the results.
   • CAdding more data sources without evaluating their contribution to intelligence quality.
   • DIncreasing the frequency of intelligence reports without assessing their usefulness.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial services firm has been running a threat intelligence program for one year. The program produces weekly reports on emerging malware families, but the security operations center (SOC) analysts rarely use them. The program manager wants to review the program's effectiveness. Which metric would best indicate whether the intelligence is meeting stakeholder needs?

   • AAverage time from threat data collection to report publication
   • BNumber of intelligence reports produced per month
   • CPercentage of intelligence reports that lead to a change in detection rules or security controls
   • DNumber of threat intelligence platforms (TIPs) integrated with the program
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A financial technology company's threat intelligence program has been in place for 18 months. The program's KPIs show high performance: 90% of reports are delivered on time, and 85% of stakeholders report satisfaction. However, the company experienced a significant data breach that the intelligence program did not predict or provide early warning for. The program manager must review the program. Which review approach is most appropriate?

   • AReplace the entire threat intelligence team because they failed to predict the breach
   • BDismiss the breach as an isolated incident and continue with the current program because the KPIs are strong
   • CBlame the SOC team for not acting on the intelligence that was provided
   • DConduct a comprehensive review that includes the breach as a case study, analyzing whether the intelligence requirements and collection plan covered the threat vectors involved
   Reveal Solution Discussion Select an answer first