Intelligence Reporting CTIA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   In a standard intelligence report, what is the purpose of the 'Key Findings' section?

   • ATo provide a step-by-step timeline of the threat actor's activities
   • BTo highlight the most important conclusions and insights from the analysis
   • CTo recommend specific security products to purchase
   • DTo list all raw data sources used in the analysis
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which writing practice best supports the standard of objectivity in an intelligence report?

   • ASpeculating about future events without labeling it as speculation
   • BPresenting facts and evidence without personal opinion or bias
   • CIncluding only information that supports a predetermined conclusion
   • DUsing emotional language to emphasize the severity of the threat
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An analyst is drafting a threat intelligence report about a phishing campaign that uses a legitimate cloud storage service to host malicious files. The analyst has high confidence in the attribution to a known threat actor. Which of the following statements best adheres to objective and clear writing standards for intelligence reports?

   • AThe phishing campaign definitely uses a legitimate cloud storage service, and the threat actor is certainly the one behind it.
   • BIt seems that the phishing campaign uses a legitimate cloud storage service, and the threat actor might be responsible.
   • CThe phishing campaign likely uses a legitimate cloud storage service, and we believe with high confidence that the threat actor is responsible.
   • DThe phishing campaign uses a legitimate cloud storage service. Based on the available evidence, the analyst assesses with high confidence that the threat actor is responsible.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A threat intelligence analyst is writing a report on a sophisticated adversary that has been evading detection. The analyst has high-confidence evidence that the adversary uses a specific command-and-control (C2) framework, but the evidence about the adversary's ultimate objective is only moderate confidence. The report will be reviewed by a senior analyst who is known to prefer assertive language. Which wording best adheres to objective writing standards while still being useful to the reader?

   • AOmit the adversary's objective entirely because it is not high-confidence, and focus only on the C2 framework.
   • BState both the C2 framework and the adversary's objective as facts, because the senior analyst prefers assertive language.
   • CUse cautious language for both the C2 framework and the adversary's objective, such as 'appears to use' and 'may be seeking'.
   • DState the C2 framework as a fact, and describe the adversary's objective as 'likely' with a brief explanation of the supporting evidence.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A threat intelligence analyst has produced a report on a coordinated attack campaign that is targeting multiple organizations in the financial sector. The report includes indicators of compromise (IOCs) and tactical recommendations. The analyst's organization is part of a sector-specific information sharing and analysis center (ISAC). The analyst must decide how to disseminate the report to maximize the benefit to the sector while protecting the organization's interests. Which of the following dissemination strategies is most appropriate?

   • AShare the report with the ISAC only after the organization has fully mitigated the attack, to avoid revealing any weaknesses.
   • BShare the full report with the ISAC, including all IOCs and recommendations, to enable sector-wide defense.
   • CShare a sanitized version of the report with the ISAC, removing any information that could identify the organization's specific weaknesses, while retaining the IOCs and general recommendations.
   • DOnly share the report internally and do not share with the ISAC, to protect the organization's competitive advantage.
   Reveal Solution Discussion Select an answer first