Dissemination of Threat Intelligence CTIA Practice Questions (Page 9)

Questions 41–44

1. 41expert · hard

   A CTI team has been disseminating monthly threat intelligence reports to various internal teams. Feedback indicates that the SOC finds the reports too high-level, while the executives find them too technical. The team must revise the dissemination process. What is the most effective approach to address this conflicting feedback?

   • AStop sending the report to the executives and focus on the SOC.
   • BMake the report more balanced so it is neither too technical nor too high-level.
   • CCreate two versions of the report: a technical version for the SOC and an executive summary for leadership.
   • DAsk the SOC and executives to compromise on a single report format.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A threat intelligence team has been disseminating weekly reports to the organization's security operations center (SOC) for several months. The SOC analysts have started ignoring the reports because they feel the information is not actionable or relevant to their current incidents. The team wants to improve the usefulness of the reports. Which action should the team take?

   • AAutomate the dissemination of raw IOCs directly to the SOC's SIEM, bypassing the weekly report.
   • BConduct a survey or interview with the SOC analysts to understand what types of intelligence they need and how they prefer to receive it.
   • CStop sending the reports and instead rely on the SOC to request intelligence as needed.
   • DIncrease the frequency of the reports to daily so the SOC sees more current information.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary purpose of establishing a feedback mechanism for threat intelligence products?

   • ATo automate the dissemination process
   • BTo evaluate the performance of individual analysts
   • CTo improve the quality and usefulness of future intelligence products
   • DTo ensure that intelligence is shared only with authorized personnel
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is the primary purpose of STIX in threat intelligence sharing?

   • ATo provide a real-time chat interface for analysts
   • BTo encrypt threat intelligence data in transit
   • CTo automate the collection of raw network traffic data
   • DTo provide a standardized language for representing and exchanging threat intelligence
   Reveal Solution Discussion Select an answer first