Intelligence Reporting CTIA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A managed security service provider (MSSP) produces a threat intelligence report about a campaign targeting its clients in the healthcare sector. The report contains sensitive information about the campaign's TTPs and IOCs. The MSSP wants to share the report with its clients and also with a national health-sector information sharing and analysis center (ISAC). Which dissemination consideration is most important?

   • AEnsure that the report is tailored to each audience and that any client-specific sensitive information is redacted before sharing with the ISAC.
   • BOnly share the report with clients who have signed a non-disclosure agreement, and do not share it with the ISAC.
   • CPublish the report on a public website so that all potential victims can benefit from the information.
   • DSend the exact same report to all clients and the ISAC to ensure consistency and speed of dissemination.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A threat intelligence team has drafted a report on a zero-day vulnerability affecting a widely used email gateway. The report contains technical details, IOCs, and recommended mitigations. The team is about to disseminate the report to system administrators and executives. Which step is most important to complete before dissemination?

   • ASend the report to the vendor of the email gateway for confirmation that the vulnerability is real.
   • BRemove all IOCs from the report to avoid tipping off the attackers.
   • CPublish the report immediately because the vulnerability is zero-day and time is critical.
   • DHave a second analyst independently verify the technical facts and IOCs, and have the team lead approve the report for release.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A threat intelligence analyst is preparing a report on a sophisticated supply chain attack that has affected several organizations in the same sector. The analyst's organization is a potential target, but there is no direct evidence of compromise. The report will be shared with the organization's executive leadership and the information sharing and analysis center (ISAC) for the sector. The analyst must balance the need for timely warning with the risk of causing unnecessary alarm. What is the most appropriate approach?

   • ADisseminate the report immediately to both audiences with a high-confidence assessment of the threat, emphasizing the potential impact.
   • BProvide a tailored report to the executive leadership with a clear risk assessment and recommended actions, while sharing a sanitized version with the ISAC that removes any proprietary information.
   • CWait for more evidence before disseminating any report, to ensure the assessment is accurate and avoid false alarms.
   • DShare the full report with the ISAC first, and then inform the executive leadership after the ISAC has validated the findings.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why is it important to have a formal approval step before disseminating an intelligence report?

   • ATo allow all employees to edit the report before release
   • BTo delay the release of time-sensitive intelligence
   • CTo remove any information that might be controversial
   • DTo ensure the report meets quality standards and is authorized for release
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A threat intelligence analyst at a financial institution has completed a detailed analysis of a new banking trojan campaign targeting the organization's customers. The analyst must now produce a report for two audiences: the executive board, who need to understand the business impact and risk, and the security operations center (SOC) analysts, who will use the technical indicators to hunt for the threat. What is the most appropriate approach for the analyst to take?

   • AWrite a single comprehensive report with all technical details and send it to both audiences to ensure no information is lost.
   • BCreate two separate reports: an executive summary focusing on risk and business impact, and a technical report with indicators and hunting guidance for the SOC.
   • CSend the technical report to the SOC and a verbal summary to the executive board, since the board does not require a written record.
   • DPublish the report on the internal wiki and let each audience access the same page, since both groups can filter the information they need.
   Reveal Solution Discussion Select an answer first