Intelligence Reporting CTIA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A threat intelligence analyst has completed a draft report on a new attack campaign targeting the organization's cloud infrastructure. The report includes sensitive information about the organization's cloud configuration and potential vulnerabilities. The report is scheduled for dissemination to the cloud operations team and the executive leadership. During the review process, the cloud operations team requests that the report be disseminated immediately, as they need the information to respond to the threat. However, the executive leadership has not yet reviewed the report. What is the best course of action?

   • ADisseminate the report to the cloud operations team immediately, and send the executive summary to leadership later.
   • BWait for the executive leadership to review the report before disseminating it to anyone.
   • CDisseminate the report to the cloud operations team without review, since they are the ones who need it most.
   • DExpedite the review process by having the executive leadership review the executive summary while the cloud operations team reviews the technical details, then disseminate the full report to both after approval.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a standard key section in a well-structured intelligence report?

   • ANetwork diagram
   • BMarketing analysis
   • CRaw log appendix
   • DExecutive summary
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat intelligence analyst has produced a report on a phishing campaign targeting the organization's employees. The report includes the sender addresses, subject lines, and recommended security awareness actions. The analyst needs to disseminate the report to the HR department and the IT security team. What is the most effective dissemination strategy?

   • ASend the full report to both HR and IT security, since both need to be aware of the campaign.
   • BOnly inform IT security and let them decide whether to involve HR.
   • CPost the report on the company intranet for all employees to see, since it contains awareness information.
   • DSend a tailored summary to HR with the awareness actions, and the full technical report to IT security.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A threat intelligence analyst is writing a report on a long-running cyber-espionage campaign. The report is intended for two audiences: the technical security team, which needs detailed IOCs and TTPs, and the executive team, which needs a high-level summary of the campaign's impact and strategic implications. The analyst has a page limit of 10 pages. Which report structure best meets the needs of both audiences within the page limit?

   • AWrite a 2-page executive summary followed by an 8-page technical appendix with IOCs and TTPs.
   • BWrite a 10-page technical report and add a one-paragraph summary at the end for executives.
   • CWrite a 10-page report that is entirely technical, and rely on a separate verbal briefing for the executive team.
   • DWrite a 10-page report that is entirely executive-focused, and provide the technical team with a link to the raw data.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A threat intelligence analyst is preparing a report for the chief information security officer (CISO) and the board of directors. Which consideration is most important when tailoring the report for this audience?

   • AIncluding detailed technical indicators of compromise (IOCs) and raw packet captures
   • BProviding a step-by-step exploitation walkthrough for each threat
   • CListing every source URL and raw log entry used in the analysis
   • DFocusing on the business impact, risk, and recommended strategic actions
   Reveal Solution Discussion Select an answer first