Intelligence Reporting CTIA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A threat intelligence analyst is preparing a weekly report for the chief information security officer (CISO) and the board of directors. The report should summarize the threat landscape, highlight significant incidents, and recommend strategic actions. Which of the following formats is most appropriate for this audience?

   • AA raw intelligence feed with unprocessed data for the board to review.
   • BA collection of all internal security alerts from the past week, with no analysis.
   • CA one-page executive summary with key findings, risk ratings, and recommended actions.
   • DA detailed technical report with all IOCs, malware hashes, and network traffic captures.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A threat intelligence analyst at a regional bank has completed a detailed technical analysis of a new banking trojan campaign targeting the organization's online banking platform. The analyst must now produce a report for the bank's board of directors, who are non-technical and primarily concerned with business risk, regulatory exposure, and resource allocation. Which report approach best meets the audience's needs?

   • AProvide a full technical deep-dive with IOCs, malware analysis details, and network indicators, assuming the board will rely on the CISO to interpret the findings.
   • BSend the full technical report unchanged, because intelligence reports must be objective and complete, and the board can ask questions if needed.
   • CWrite an executive summary that highlights the business impact, likelihood, regulatory implications, and recommended strategic actions, with technical details placed in an appendix.
   • DIssue a short alert listing the indicators of compromise and recommended blocking rules, since the board only needs to know that action is being taken.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is writing a threat intelligence report on a series of DDoS attacks against the company's public-facing web services. The analyst has data from multiple sources, including firewall logs, ISP reports, and open-source intelligence. Which writing practice best ensures the report is objective and credible?

   • AUse strong language such as 'definitely' and 'certainly' to convey confidence in the findings, even when the evidence is incomplete.
   • BClearly distinguish between observed facts, analyst judgments, and speculative hypotheses, and cite the sources for each key claim.
   • CPresent the data in a single narrative that blends facts and interpretations to make the report easier to read.
   • DInclude only the data that supports the analyst's conclusion, and omit conflicting data to keep the report concise.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A threat intelligence analyst is preparing a report on a new phishing campaign that is targeting the organization's employees. The report includes the sender addresses, subject lines, and recommended security awareness actions. The analyst needs to disseminate the report to the HR department and the IT security team. The HR department wants a simple one-page summary, while the IT security team wants the full technical details. The analyst must also ensure that the report is approved by the supervisor before dissemination. What is the most appropriate approach?

   • ASend the full technical report to the supervisor for approval, and then let the supervisor decide what to send to HR and IT security.
   • BCreate two versions of the report: a one-page summary for HR and a full technical report for IT security, and submit both to the supervisor for approval.
   • CSend the full technical report to both HR and IT security, since both need to be aware of the campaign.
   • DSend the one-page summary to HR and the full technical report to IT security, but do not wait for supervisor approval, since the report is time-sensitive.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of an intelligence report in the context of threat intelligence?

   • ATo archive raw data for future forensic investigations
   • BTo communicate analyzed information that supports decision-making and action
   • CTo satisfy regulatory compliance requirements exclusively
   • DTo replace the need for real-time alerting systems
   Reveal Solution Discussion Select an answer first