Dissemination of Threat Intelligence CTIA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   After disseminating a series of threat intelligence reports, a CTI team notices that the SOC frequently requests clarifications and the executives rarely read the full reports. The team wants to improve the effectiveness of future dissemination. What should they do first?

   • AMake the reports more technical to satisfy the SOC and more detailed for the executives.
   • BIncrease the frequency of reports to keep everyone more engaged.
   • CStop sending reports to the executives and focus only on the SOC.
   • DEstablish a formal feedback mechanism, such as surveys or feedback forms, to understand consumer needs and preferences.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A threat intelligence team needs to share intelligence with a partner organization that uses a different threat intelligence platform. The partner's platform supports STIX but not TAXII. The team must ensure the partner can ingest the intelligence automatically. What is the most appropriate approach?

   • AExport the intelligence in STIX format and provide it via a secure file transfer method that the partner can ingest.
   • BUse TAXII to push the intelligence to the partner, assuming they can configure it.
   • CSend a PDF report to the partner and ask them to manually enter the indicators.
   • DConvert the intelligence to CSV and email it to the partner.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A threat intelligence team at a large enterprise regularly publishes weekly intelligence reports to the security operations center (SOC) and incident response (IR) team. The SOC manager complains that the reports are too long and the indicators are buried, while the IR lead says the reports often arrive after an incident has already been detected. The team wants to improve the dissemination process. Which action should the team take first?

   • AAutomate the delivery of indicators to the SIEM via a TAXII feed so the SOC can access them in real time.
   • BInterview the SOC and IR consumers to understand their specific needs, then redesign the report format and delivery schedule accordingly.
   • CShorten the reports to one page and put the top five indicators in a table at the top.
   • DCreate a dashboard that shows the latest intelligence and send a link to the SOC and IR teams.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A threat intelligence team needs to share indicators of compromise with an external partner organization. The partner's security tools support automated ingestion of threat intelligence feeds. Which method is most appropriate for this sharing?

   • APost the indicators on a public website
   • BPublish the indicators in a STIX/TAXII feed
   • CEmail a spreadsheet with the indicators
   • DFax the indicators to the partner
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A CTI team has implemented a feedback mechanism for its threat intelligence products. The SOC has provided feedback that the reports are too long and not actionable. The executives have provided feedback that they want more strategic context. The team must revise the dissemination process. What is the most effective way to use this feedback?

   • ASend the same report to both audiences but with a note explaining the content.
   • BCreate a tiered reporting structure: a brief actionable summary for the SOC and a strategic overview for executives.
   • CIgnore the feedback and continue with the current format.
   • DMake the reports longer to include both actionable details and strategic context.
   Reveal Solution Discussion Select an answer first