Dissemination of Threat Intelligence CTIA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a fast-moving ransomware campaign, a threat intelligence analyst has confirmed new indicators and updated TTPs. The SOC needs to block the indicators immediately, while the incident response team needs the updated TTPs to contain the spread. What is the most appropriate dissemination action?

   • AInclude the new indicators in the next monthly threat report to avoid alert fatigue.
   • BWait for the next scheduled weekly report to ensure accuracy and completeness.
   • CSend an immediate alert with the new indicators to the SOC and a briefing to the incident response team.
   • DPublish the information on the internal wiki and wait for teams to check it.
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   A threat intelligence team at a government agency has been disseminating intelligence products to various internal teams, including the SOC, the threat hunting team, and the executive leadership. The SOC has provided feedback that the indicators are often outdated by the time they receive them, while the threat hunting team has complained that the reports lack sufficient context for proactive hunting. The executive leadership has not provided any feedback. The team has limited resources and cannot produce multiple versions of each product. What should the team do to address the feedback?

   • ACreate a single report that includes both indicators and context, and send it to all teams via email.
   • BPrioritize the SOC's feedback and focus on delivering indicators faster, even if it means less context.
   • CStop disseminating reports and instead rely on the teams to request intelligence as needed.
   • DConduct a survey of all consumers, including the executive leadership, to understand their needs and preferences, then redesign the dissemination process accordingly.
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   A threat intelligence analyst at a multinational corporation has produced a report on a new ransomware campaign targeting the company's subsidiaries in different regions. The report includes technical indicators, a detailed analysis of the ransomware's behavior, and an assessment of the potential impact on each region. The analyst must share this with the regional IT security teams, the global CISO, and the regional legal counsels. The regional teams have different technical capabilities and regulatory requirements. What is the most effective dissemination strategy?

   • AHold a single global conference call with all regional IT security teams, the CISO, and all legal counsels to discuss the report.
   • BProvide each regional IT security team with a technical brief tailored to their capabilities, give the global CISO an executive summary, and provide each regional legal counsel with a summary of regulatory implications for their region.
   • CPost the report on the company's intranet and send a link to all regional IT security teams, the CISO, and all legal counsels.
   • DSend the full report to all regional IT security teams, the global CISO, and all regional legal counsels.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What does 'relevance' mean in the context of threat intelligence dissemination?

   • AThe intelligence is applicable to the consumer's environment, mission, and current threats
   • BThe intelligence is delivered in a format that is easy for machines to parse
   • CThe intelligence is sourced from a single trusted provider
   • DThe intelligence is delivered to all possible recipients regardless of their needs
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A threat intelligence analyst at a financial institution has identified a new phishing kit that is being used to target the institution's customers. The analyst has created a detailed analysis report, but the report is scheduled to be published in the weekly intelligence bulletin, which is three days away. The SOC has requested the indicators immediately to update their blocklists. What should the analyst do?

   • ASend a preliminary alert to the SOC with the indicators and a brief description, and include the full report in the weekly bulletin.
   • BWait for the weekly bulletin to publish the report, as it is the standard dissemination channel.
   • CPublish the full report on the internal wiki and send a link to the SOC, bypassing the weekly bulletin.
   • DAsk the SOC to wait for the weekly bulletin, as the report will be more comprehensive and useful.
   Reveal Solution Discussion Select an answer first