Introduction to Threat Intelligence CTIA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A managed security service provider (MSSP) serves multiple clients with varying security maturity. One client is a small law firm that needs a high-level risk summary for partners. Another client is a large tech company that needs detailed TTPs for its SOC. The MSSP has a single intelligence team and must produce both types of reports efficiently. What is the most effective strategy?

   • AFocus on operational intelligence for both clients, as it covers ongoing campaigns
   • BProvide only tactical intelligence to both clients, as it is more detailed
   • CSend the same raw threat data to both clients and let them interpret it
   • DProduce strategic intelligence for the law firm and tactical intelligence for the tech company, using the same underlying data but different analysis and presentation
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A government agency wants to participate in a threat intelligence sharing community but is concerned about the sensitivity of its indicators and the risk of exposing sources. The agency also needs to automate the exchange with partner agencies. Which approach best addresses both concerns?

   • AShare all indicators publicly on an open platform to maximize visibility
   • BUse email to share indicators with trusted partners manually
   • CJoin a trusted sharing community that uses STIX/TAXII and enforce data sanitization and anonymization policies before sharing
   • DAvoid sharing altogether and only consume intelligence from others
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A regional bank's board of directors is deciding whether to increase investment in cybersecurity. The CISO must present a high-level briefing that explains the threat landscape, the bank's exposure, and the financial and reputational risks—without technical jargon. Which type of threat intelligence should the CISO primarily rely on for this briefing?

   • AOperational threat intelligence
   • BTechnical threat intelligence
   • CTactical threat intelligence
   • DStrategic threat intelligence
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does threat intelligence differ from threat data?

   • AThreat data is only from internal sources, while threat intelligence is only from external sources
   • BThreat data is always accurate, while threat intelligence may contain errors
   • CThreat intelligence is a subset of threat data
   • DThreat intelligence is processed and analyzed, while threat data is raw and unprocessed
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of the Cyber Kill Chain framework?

   • ATo automate incident response
   • BTo provide a list of all known malware hashes
   • CTo replace the need for threat intelligence feeds
   • DTo describe the stages of a cyberattack from reconnaissance to actions on objectives
   Reveal Solution Discussion Select an answer first