Dissemination of Threat Intelligence CTIA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is an example of an automated dissemination channel for threat intelligence?

   • AA live briefing delivered by an analyst to the SOC team
   • BA TAXII feed that pushes indicators to a SIEM platform
   • CA printed bulletin posted on a physical notice board
   • DA monthly PDF report emailed to stakeholders
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A threat intelligence team at a large enterprise has been disseminating a monthly intelligence report to the security operations center (SOC) and the incident response (IR) team. The SOC team has provided feedback that the report is too long and the indicators are not prioritized, while the IR team has complained that the report often arrives after an incident has already occurred. The team has limited resources and cannot produce multiple versions of the report. What should the team do to address both concerns?

   • AStop sending the monthly report and instead rely on the SOC and IR teams to request intelligence as needed.
   • BSend the report only to the SOC, since they are the primary consumers, and let them share relevant information with the IR team.
   • CImplement an automated feed of indicators to the SOC's SIEM for real-time access, and continue sending the monthly report for context.
   • DCreate a single, shorter report with a prioritized list of indicators at the top and send it to both teams via email.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A threat intelligence analyst needs to provide real-time updates on emerging threats to a geographically dispersed security team. The team members work in different time zones and need to access the information at any time. Which dissemination channel is most appropriate?

   • AA printed bulletin posted in the office
   • BA scheduled conference call every morning
   • CAn email sent once a week
   • DA continuously updated dashboard accessible via the web
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A threat intelligence team wants to share structured threat intelligence with external partners using a standardized format that supports the full range of threat information, including indicators, TTPs, and campaign context. Which format should they choose?

   • ASTIX
   • BCSV
   • CHTML
   • DPDF
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A threat intelligence platform (TIP) needs to automatically share indicators of compromise (IOCs) with partner organizations' security tools. The sharing must be machine-readable, support real-time updates, and follow a widely adopted standard. Which combination of format and transport should the analyst choose?

   • AJSON over SFTP
   • BCSV over email
   • CSTIX over TAXII
   • DPDF reports via a web portal
   Reveal Solution Discussion Select an answer first