Dissemination of Threat Intelligence CTIA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A threat intelligence analyst discovers a critical zero-day vulnerability being exploited in the wild against the organization's web servers. The analyst has prepared a detailed technical report with indicators of compromise (IOCs), but the report is not yet finalized because the analyst wants to add more context and historical background. The CISO is about to give a quarterly briefing to the board. What should the analyst do?

   • APost the IOCs on the internal wiki and send an email to the entire company asking them to review the report.
   • BWait until the report is fully polished and then send it to the SOC and the CISO together.
   • CImmediately send a short alert to the SOC with the IOCs and a brief description of the exploitation, and follow up with the full report later.
   • DSend the full report to the CISO first, since the board briefing is imminent, and let the CISO decide what to share with the SOC.
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A threat intelligence platform (TIP) vendor wants to support sharing of threat intelligence with multiple customers who use different security tools. The vendor needs to ensure that the intelligence is machine-readable and can be integrated with minimal custom development. The vendor also wants to support both real-time and batch sharing. Which approach should the vendor take?

   • ASend intelligence as PDF reports via email to each customer's security team.
   • BDevelop a proprietary JSON API and provide client libraries for each security tool the customers use.
   • CExport intelligence as CSV files and host them on an FTP server for customers to download.
   • DUse STIX for the data format and TAXII for the transport protocol, and provide TAXII clients for customers to pull intelligence.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which dissemination channel is most appropriate for providing a high-level summary of threat trends to executive leadership?

   • AAn executive briefing
   • BA raw packet capture
   • CA technical indicator feed
   • DA vulnerability scan report
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In the intelligence lifecycle, what is the primary purpose of the dissemination phase?

   • ATo evaluate the accuracy of intelligence sources and methods
   • BTo deliver processed intelligence to the right consumers in a usable form
   • CTo transform raw data into a structured format for storage
   • DTo collect raw data from multiple sources for further analysis
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which factor is most important when determining the content and format of a threat intelligence product?

   • AThe personal preference of the intelligence analyst
   • BThe audience's role and information needs
   • CThe availability of open-source tools
   • DThe length of the original raw data
   Reveal Solution Discussion Select an answer first