Dissemination of Threat Intelligence CTIA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A threat intelligence team in a multinational corporation needs to disseminate a new intelligence product about a phishing campaign targeting the company's employees. The team has identified that the SOC needs to block the phishing domains, the help desk needs to recognize and report phishing emails, and the executive team needs to understand the business risk. Which dissemination method best addresses the needs of all three groups?

   • ASend a company-wide email with the full technical report attached, so everyone has the same information.
   • BSend a technical alert with IOCs to the SOC, a short awareness bulletin with examples and reporting instructions to the help desk, and an executive summary with risk and impact to the executive team.
   • CPublish a single detailed report on the internal portal and send a link to all employees.
   • DHold a single town-hall meeting to present the phishing campaign to all employees, including the SOC and executives.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A threat intelligence analyst at a regional bank has produced a detailed report on a new banking trojan campaign targeting the bank's specific online banking platform. The report includes deep technical indicators (C2 domains, file hashes, YARA rules) and a strategic assessment of the threat actor's likely next moves. The analyst must disseminate this to the bank's security operations center (SOC) analysts, the CISO, and the fraud investigation team. Which approach best meets the needs of all three audiences?

   • AHold a single briefing for all three groups, walking through the entire report slide by slide, and then email the full report afterward.
   • BPublish the full report on the internal wiki and send a one-line notification to all three groups with a link.
   • CProvide the SOC with a technical brief containing IOCs and detection rules, give the CISO an executive summary with risk and business impact, and brief the fraud team on the specific fraud indicators and response steps.
   • DSend the full technical report to all three groups via email, with a note that the strategic assessment is at the end.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following is an effective method for collecting feedback on threat intelligence dissemination?

   • AMonitoring social media for mentions of the intelligence product
   • BComparing the intelligence product to competitor products
   • CConducting post-incident surveys with intelligence consumers
   • DReviewing the raw data sources used to create the product
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Why is timeliness a critical factor in threat intelligence dissemination?

   • ABecause all threat intelligence must be shared within 24 hours of collection
   • BBecause delayed dissemination always results in data breaches
   • CBecause timeliness is more important than accuracy in all cases
   • DBecause outdated intelligence can lead to ineffective or missed responses to current threats
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A threat intelligence team must disseminate time-sensitive intelligence about an active campaign to a large number of internal and external stakeholders. The internal stakeholders need detailed technical information, while external partners need a standardized, machine-readable format. The team has limited time and must ensure the intelligence is disseminated quickly. What is the most efficient approach?

   • ACreate a comprehensive report and email it to all stakeholders.
   • BUse a conference call to brief all stakeholders at once.
   • CPublish the intelligence on a public website and rely on stakeholders to check it.
   • DSend a brief alert to internal stakeholders and publish a STIX/TAXII feed for external partners.
   Reveal Solution Discussion Select an answer first