Intelligence Reporting CTIA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A threat intelligence analyst is preparing a report on a new malware family that is being used in targeted attacks against the organization's industry. The report will be shared with the organization's SOC, the executive leadership, and a partner organization. The analyst must ensure that the report is structured to meet the needs of all three audiences. Which of the following structures is most appropriate?

   • AA single report with all technical details, and a separate one-page summary for leadership and the partner.
   • BA single report with an executive summary, technical analysis, and recommendations, with a classification marking and distribution list.
   • CThree separate reports: an executive summary for leadership, a technical report for the SOC, and a partner-specific report with only the information the partner needs.
   • DA single report with the executive summary first, followed by the technical analysis, and a note that the partner should only read the executive summary.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A threat intelligence analyst has drafted a report on a new ransomware strain that is actively targeting the organization's industry. The report contains sensitive information about the organization's network architecture and a zero-day vulnerability that the ransomware exploits. The report is scheduled for dissemination to the incident response team and the executive leadership. During the review process, the legal department raises concerns about the inclusion of the zero-day vulnerability details, as it may increase the organization's liability if the report is leaked. The analyst must decide how to proceed. What is the best course of action?

   • ARemove the zero-day vulnerability details from the report and disseminate it without them, since legal has raised concerns.
   • BWork with legal and the incident response team to redact the most sensitive details, and provide the full details only to the incident response team under a non-disclosure agreement.
   • CKeep the zero-day vulnerability details in the report and disseminate it as planned, since the incident response team needs them.
   • DDelay dissemination until the zero-day vulnerability is patched, so the details are no longer sensitive.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A threat intelligence team has produced a report on a zero-day exploit that is being used in the wild. The report contains IOCs and mitigation steps. The team wants to share the report with its customers, but the report also contains information about a vulnerability in a third-party product that is not yet patched. The third-party vendor has asked the team not to disclose the vulnerability details publicly. What is the best dissemination strategy?

   • AShare a redacted version of the report with customers that includes IOCs and generic mitigations, but omits the specific vulnerability details that the vendor asked to keep confidential.
   • BWithhold the report entirely until the vendor releases a patch, to avoid any risk of disclosure.
   • CShare the full report with customers but ask them to sign a non-disclosure agreement to keep the vulnerability details secret.
   • DShare the full report with customers immediately, because they need to protect themselves from the zero-day exploit.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A threat intelligence analyst has completed a draft report on a supply-chain attack that affected the company's third-party software vendor. The report includes technical details, impact assessment, and recommended actions. The analyst's supervisor is out of the office for two weeks. What is the best course of action to ensure the report is reviewed and approved in a timely manner?

   • ADisseminate the report immediately because the supervisor's absence should not delay critical intelligence.
   • BAsk a peer analyst to review the report for accuracy and then disseminate it, noting that the supervisor is unavailable.
   • CFollow the organization's escalation procedure to obtain approval from an alternate approver, such as the CISO or another manager.
   • DSend the report to the supervisor for review via email and wait for their return to get approval.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which step is typically part of the review and approval process for an intelligence report?

   • ADeleting all source references to protect confidentiality
   • BRewriting the report to match the audience's preferred conclusions
   • CPeer review by another analyst for accuracy and completeness
   • DAutomatic publication without any human review
   Reveal Solution Discussion Select an answer first