Intelligence Reporting CTIA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a key consideration when disseminating an intelligence report to external stakeholders?

   • AEnsuring the report is encrypted and shared only with authorized recipients
   • BAvoiding any form of encryption to simplify access
   • CSharing the report with all external partners without restrictions
   • DPosting the report on a public website for transparency
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A threat intelligence analyst is writing a formal intelligence report on a newly identified Advanced Persistent Threat (APT) group. The report will be reviewed by a senior analyst and then disseminated to the organization's security leadership. Which of the following structures best conforms to standard intelligence reporting practices?

   • APresent the recommendations first, followed by the analysis, and then the executive summary to emphasize action items.
   • BStart with the raw data and collection methods, then present the analysis, and end with a summary of the threat.
   • CBegin with an executive summary, then provide the key findings, detailed analysis, and end with recommendations and dissemination restrictions.
   • DInclude all raw data in the main body and place the analysis in an appendix for readers who want the full detail.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A threat intelligence analyst is writing a finished intelligence report on a phishing campaign that targeted the company's finance department. The analyst has confirmed the campaign's TTPs, identified the lure documents, and traced the infrastructure to a known threat group. The report must be reviewed by the CISO before dissemination. Which report structure best supports the review and approval process?

   • ABegin with a detailed timeline of the phishing campaign, then list all IOCs, and finally state the conclusion at the end of the report.
   • BPresent only the raw data—emails, logs, and malware hashes—without analysis, so the CISO can form an independent conclusion.
   • CWrite a narrative that describes the investigation step-by-step, leaving the conclusion and recommendations for a separate verbal briefing.
   • DStart with a conclusion and key judgments, then provide the body with evidence and analysis, and end with recommendations and an appendix of IOCs.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A threat intelligence analyst has completed a draft report on a new malware strain. The report is scheduled for dissemination to the organization's incident response team and system administrators. The analyst's supervisor is on leave, and the report is time-sensitive. What is the best course of action?

   • APublish the report on the internal portal without review, since the team can access it immediately.
   • BWait for the supervisor to return to review the report, even if it delays dissemination.
   • CAsk another senior analyst to review the report and approve it for dissemination.
   • DDisseminate the report immediately to ensure the team can respond to the threat without delay.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A threat intelligence analyst has produced a report on a zero-day vulnerability affecting the organization's internet-facing systems. The report includes technical details and indicators of compromise (IOCs). The analyst needs to disseminate this report to the IT security team and the executive leadership. What is the most appropriate dissemination method?

   • AEmail the full report to all employees to ensure maximum awareness and transparency.
   • BVerbally brief the IT security team and email the executive summary to leadership, since written reports are not necessary for either group.
   • CPublish the report on a public threat intelligence sharing platform to help the broader community.
   • DSend the full report to the IT security team via a secure channel, and provide an executive summary to the leadership with a link to the full report if needed.
   Reveal Solution Discussion Select an answer first