Direction and Review of the Threat Intelligence Program CTIA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   After a quarterly review, a threat intelligence program finds that its finished intelligence reports are rarely read by executives, who prefer a one-page summary. The team also notices that the SOC often misses critical alerts because they are buried in lengthy reports. The team wants to improve the program's effectiveness. Which action best addresses the review findings?

   • AContinue producing the current reports but send them more frequently to ensure executives see them.
   • BStop producing reports and instead provide raw intelligence feeds to executives and the SOC.
   • CRedesign the reports to include a one-page executive summary and highlight actionable alerts for the SOC.
   • DAsk the SOC to review the reports and extract the critical alerts themselves.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A technology startup is building a threat intelligence program from scratch. The CEO wants the program to support rapid product development and market expansion, while the CISO wants to focus on protecting intellectual property and customer data. The program manager must define the program's strategic direction. Which approach best reconciles these competing priorities?

   • APrioritize the CEO's goal of market expansion, as business strategy should drive all security investments
   • BDevelop a strategic direction that integrates both goals by focusing intelligence on threats that could impact product development, market entry, and the protection of intellectual property and customer data
   • CDefer the strategic direction decision until the program has collected enough threat data to inform the strategy
   • DPrioritize the CISO's focus on protecting intellectual property and customer data, as security is the program's primary purpose
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of defining the strategic direction of a threat intelligence program?

   • ATo select the most advanced threat intelligence tools and technologies available on the market.
   • BTo assign daily tasks to threat intelligence analysts and manage their workload.
   • CTo ensure the program's mission and vision align with the organization's overall goals and objectives.
   • DTo comply with external regulatory requirements for threat intelligence reporting.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A large hospital network is defining the strategic direction of its threat intelligence program. The program must support patient safety, regulatory compliance, and operational continuity. The program manager is drafting the mission and vision. Which combination of mission and vision best supports the hospital's goals?

   • AMission: To monitor all network traffic for malicious activity. Vision: To be the best security team in the hospital.
   • BMission: To comply with all healthcare regulations. Vision: To pass all audits with no findings.
   • CMission: To provide actionable intelligence that safeguards patient safety, ensures regulatory compliance, and supports uninterrupted operations. Vision: To be a model of security resilience in healthcare.
   • DMission: To protect patient data and ensure regulatory compliance. Vision: To achieve zero data breaches.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A multinational retail company is establishing a threat intelligence program. The board has approved funding but insists that the program directly support the organization's strategic objective of expanding into new geographic markets. The CISO asks you to draft the program's mission statement. Which mission statement best aligns the program with the organizational goal?

   • ATo provide timely, actionable intelligence that informs risk decisions and protects business operations, including secure entry into new markets.
   • BTo collect and analyze threat data from all available sources to produce comprehensive intelligence reports for the security team.
   • CTo monitor competitor activities and market trends to identify potential security threats to the company's brand reputation.
   • DTo ensure all security incidents are detected and responded to within one hour of occurrence across all global operations.
   Reveal Solution Discussion Select an answer first