Intelligence Reporting CTIA Practice Questions (Page 8)

Questions 36–39

1. 36application · medium

   A threat intelligence analyst at a university is preparing a report on a phishing campaign that targeted student email accounts. The report will be shared with the university's IT help desk, the dean of students, and the campus security office. Which report format is most appropriate for this mixed audience?

   • AA single technical report with all details, since the help desk and security office need the technical information and the dean can rely on them.
   • BA brief email alert to all recipients, with a link to the full report for those who want more detail.
   • CA single report with an executive summary for leadership, a technical section for the help desk, and an operational section for campus security.
   • DA separate report for each audience, each containing only the information that group needs to know.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A threat intelligence team has completed a draft report on a ransomware group's new tactics, techniques, and procedures (TTPs). The report contains sensitive information about the organization's vulnerabilities and will be shared with a limited group of stakeholders. According to the review and approval process, what should the team do before disseminating the report?

   • AOnly have the report reviewed by the analyst who wrote it, since they have the most context and can ensure accuracy.
   • BHave the report reviewed by a senior analyst for accuracy and by the legal or compliance team for any regulatory concerns, then obtain formal approval from the designated authority.
   • CPublish the report on the internal threat intelligence portal and notify stakeholders via email, since the portal is access-controlled.
   • DSend the report directly to the stakeholders to ensure timely action, since the analysis is already complete.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   An analyst is writing a threat intelligence report on a nation-state actor's activities. The report will be reviewed by a senior analyst and then disseminated to the organization's executive leadership and a government partner. The analyst has information from a confidential source that is not yet fully corroborated. The analyst must decide how to present this information in the report. What is the most appropriate approach?

   • AOmit the information entirely, since it is not fully corroborated.
   • BInclude the information as fact, since the source is considered reliable.
   • CInclude the information with a clear caveat about its source and confidence level, and explain its potential significance.
   • DInclude the information in a separate annex labeled 'unverified', but do not reference it in the main body.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An analyst is writing a threat intelligence report on a new exploit kit. The report will be shared with the organization's security operations center (SOC) and management. Which of the following elements should be included in the report to ensure it is complete and useful?

   • AAn executive summary, key findings, technical analysis, indicators of compromise, and recommended actions.
   • BA list of all sources used, with no analysis or recommendations.
   • COnly the technical indicators and detection rules, since the SOC is the primary audience.
   • DA detailed description of the exploit kit's code, with no summary or recommendations.
   Reveal Solution Discussion Select an answer first