Direction and Review of the Threat Intelligence Program CTIA Practice Questions (Page 9)

Questions 41–43

1. 41application · medium

   A threat intelligence program has been running for a year. The review process uses a balanced scorecard approach with metrics in four categories: quality, timeliness, relevance, and stakeholder satisfaction. During the review, the team finds that while quality scores are high, stakeholder satisfaction is low because reports are often delivered after decisions are made. Which metric should the team prioritize improving?

   • AQuality of the intelligence analysis.
   • BNumber of intelligence reports produced.
   • CTimeliness of intelligence delivery.
   • DRelevance of the intelligence topics.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A manufacturing company's threat intelligence program review shows that the program meets all its KPIs: 95% of reports are delivered on time, and 80% of stakeholders rate the reports as useful. However, a post-incident analysis reveals that the intelligence did not contain the specific indicators needed to detect a cyber-physical attack that occurred last month. The program manager must decide how to improve the program. Which action is most appropriate?

   • AConduct a lessons-learned session with the incident response team and update the intelligence requirements to include cyber-physical threat indicators
   • BIncrease the frequency of intelligence reports to ensure more timely delivery of indicators
   • CExpand the stakeholder group to include external partners who can provide additional intelligence
   • DReplace the current threat intelligence platform with one that has more automated collection capabilities
   Reveal Solution Discussion Select an answer first
3. 43application · medium

   A threat intelligence program is being reviewed. The team has been tracking the number of intelligence reports produced, the number of indicators of compromise (IOCs) shared, and the number of briefings delivered. The CISO wants to know if the program is effective. Which additional metric would best help assess effectiveness?

   • AThe number of times intelligence was used in security decisions.
   • BThe number of hours spent on intelligence collection.
   • CThe number of threat intelligence tools used.
   • DThe number of analysts on the team.
   Reveal Solution Discussion Select an answer first