Direction and Review of the Threat Intelligence Program CTIA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary role of business unit managers in the direction and review of a threat intelligence program?

   • ATo implement technical security controls based on intelligence reports.
   • BTo provide requirements and feedback on intelligence relevance to their business functions.
   • CTo conduct forensic analysis of security incidents.
   • DTo develop and maintain the threat intelligence platform's software code.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   After the annual review of a threat intelligence program, the review team finds that the program consistently meets its KPIs for report timeliness but that the intelligence has not influenced any major security decisions during the year. The program manager wants to improve the program's effectiveness. Which action should the program manager take first?

   • AReassess the intelligence requirements with key stakeholders to ensure the products align with their decision-making processes
   • BReduce the number of stakeholders to simplify the reporting process
   • CPurchase a more advanced threat intelligence platform to automate report generation
   • DIncrease the frequency of intelligence reports from weekly to daily
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A national retail chain's threat intelligence program has a KPI that 100% of high-priority intelligence reports must be delivered within 4 hours. The program consistently achieves 98%. The program manager believes the remaining 2% is due to manual review bottlenecks. The program manager wants to improve the KPI without sacrificing quality. Which action is most effective?

   • AAutomate parts of the review process, such as initial triage and formatting, while retaining human oversight for final approval
   • BRemove the KPI entirely and rely on stakeholder feedback to assess timeliness
   • CReduce the number of high-priority reports by reclassifying some as routine
   • DIncrease the KPI threshold to 6 hours to make the target easier to achieve
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A healthcare organization is designing its threat intelligence program. The program will provide intelligence to the incident response team, the fraud investigation unit, and the executive board. The program manager must define stakeholder roles. Which approach best ensures that each stakeholder group receives relevant intelligence?

   • ACreate tailored intelligence products for each stakeholder group based on their specific responsibilities and decisions
   • BFocus exclusively on the executive board's requirements because they approve the budget
   • CLet each stakeholder group define its own intelligence requirements without central coordination
   • DSend all intelligence reports to all stakeholders to ensure no one misses critical information
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial services firm is reviewing its threat intelligence program. The review team includes the CISO, the head of fraud detection, and the SOC manager. The CISO wants to ensure that the review considers the needs of all key stakeholders. Which additional stakeholder should be included to provide the most critical perspective for this firm?

   • AThe head of legal and compliance to ensure regulatory requirements are addressed.
   • BThe IT help desk manager to ensure end-user support is aligned with intelligence findings.
   • CThe chief marketing officer (CMO) to ensure the program's reputation is protected.
   • DThe chief financial officer (CFO) to ensure the program stays within budget.
   Reveal Solution Discussion Select an answer first