Direction and Review of the Threat Intelligence Program CTIA Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A large healthcare organization is reviewing its threat intelligence program. The program currently serves the security team and the compliance office. The organization is planning to launch a telemedicine service, which introduces new cyber risks and regulatory requirements. The CISO wants to ensure the program's direction supports this new service. Which stakeholder should be added to the program's review team to best inform the direction?

   • AThe external public relations firm to manage the launch announcement.
   • BThe human resources director to manage staffing for the new service.
   • CThe facilities manager to ensure physical security of new offices.
   • DThe telemedicine service product manager.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A government contractor is establishing a threat intelligence program. The organization's primary goal is to protect classified information systems from advanced persistent threats (APTs). The program's vision statement should reflect the desired future state. Which vision statement is most appropriate?

   • ATo maintain a comprehensive database of all known malware signatures
   • BTo achieve a state where APT activity is detected and disrupted before it can compromise classified systems
   • CTo ensure that all employees receive annual security awareness training
   • DTo become the leading provider of threat intelligence in the industry
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   A threat intelligence program has been using the same set of KPIs for three years. The KPIs include the number of reports produced, the number of IOCs shared, and the number of briefings delivered. A review shows that these KPIs are all being met, but the program's overall effectiveness is questioned by senior leadership. The program manager must revise the KPIs. Which KPI set would best demonstrate the program's value to senior leadership?

   • ANumber of reports produced, number of IOCs shared, and number of briefings delivered.
   • BNumber of sources monitored, number of analysts on the team, and number of tools used.
   • CNumber of intelligence reports read by stakeholders, number of follow-up questions, and number of briefings requested.
   • DPercentage of intelligence requirements met, number of security decisions influenced, and reduction in time to detect and respond to threats.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A global bank's threat intelligence program has been running for two years. The program produces high-quality strategic reports that the board uses for risk decisions. However, the SOC team reports that the tactical indicators (IOCs) provided are often outdated by the time they are delivered, and the fraud team says the intelligence does not address financial crime patterns. The program manager must revise the program's KPIs. Which KPI set would best balance the needs of all three stakeholder groups?

   • AFocus KPIs solely on the number of intelligence products delivered per week
   • BSet a single KPI for overall stakeholder satisfaction without specific metrics
   • CReplace all strategic reporting with real-time IOC feeds to satisfy the SOC
   • DMaintain the current strategic report quality, add a KPI for IOC delivery time under 2 hours, and add a KPI for fraud-related intelligence coverage
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A threat intelligence program's annual review reveals that the program's KPIs are not being met. The team identifies that the intelligence requirements are too broad and not prioritized. The program manager wants to use the review findings to improve the program. Which action best supports continuous improvement?

   • ARevise the intelligence requirements to be more specific and prioritized based on stakeholder input.
   • BKeep the requirements unchanged but set lower KPI targets.
   • CDiscontinue the program and start over with a new team.
   • DIncrease the number of analysts to produce more intelligence.
   Reveal Solution Discussion Select an answer first