Threat Intelligence Evaluation and Runbook Creation CTIA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is developing a runbook for handling a data breach involving stolen credentials. The runbook must define triggers, steps, roles, and decision points. Which element is a trigger for initiating the runbook?

   • AA scheduled quarterly review of the runbook.
   • BThe completion of a security awareness training session.
   • CDetection of a successful login from an unusual geographic location.
   • DThe availability of new threat intelligence reports.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which component is typically included in the structure of a threat intelligence runbook?

   • AA list of all employees' contact information
   • BA detailed history of the organization's incidents
   • CA set of triggers and predefined response steps
   • DA list of all software licenses owned by the organization
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the first step in developing a threat intelligence runbook?

   • AHiring additional security staff
   • BPurchasing new security tools
   • CDefining the trigger conditions that initiate the runbook
   • DWriting the final report for management
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC manager is reviewing the runbook for a ransomware incident. The runbook is comprehensive, but it is 15 pages long and includes detailed steps for every possible scenario. The SOC team has complained that it is too complex and difficult to follow during a high-pressure incident. What is the most appropriate action for the manager to take?

   • AKeep the runbook as is, as it is comprehensive and covers all possible scenarios.
   • BDelete the detailed runbook and replace it with the one-page cheat sheet.
   • CCreate a simplified, one-page 'cheat sheet' version for quick reference during an incident.
   • DRequire the team to memorize the runbook.
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A multinational organization is evaluating two threat intelligence sources: a commercial feed that provides real-time IOCs with high confidence scores, and an open-source feed that provides contextual reports but with a 24-hour delay. The organization's SOC has a limited budget and must decide which source to integrate. The SOC's primary concern is reducing false positives in their SIEM. Which approach best balances the trade-offs?

   • AIntegrate only the open-source feed because it is free and provides context.
   • BIntegrate the commercial feed for real-time blocking and use the open-source feed for contextual enrichment and validation.
   • CReject both feeds and rely solely on internal detection mechanisms.
   • DIntegrate only the commercial feed because real-time IOCs are always more valuable than delayed context.
   Reveal Solution Discussion Select an answer first