Threat Intelligence Program Requirements and Planning CTIA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A threat intelligence team produces a detailed analysis of a new phishing campaign targeting the organization's employees. The analysis includes technical indicators, campaign tactics, and recommended mitigations. Which dissemination approach is most appropriate?

   • APost the report on the internal wiki and wait for stakeholders to read it.
   • BPresent the report only to the CISO, since they are the primary decision-maker.
   • CSend a tailored summary to executives and a detailed technical report to the SOC and incident response teams.
   • DEmail the full technical report to all employees to raise awareness.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A threat intelligence analyst discovers a vulnerability in a third-party product used by the organization. The analyst wants to share this information with a national CERT. The organization's legal team is concerned about potential liability and data privacy regulations. What should the analyst do?

   • AFollow the organization's disclosure policy and coordinate with legal before sharing any information.
   • BShare the vulnerability details immediately with the CERT to prevent exploitation.
   • CKeep the vulnerability secret to avoid any legal risk.
   • DPublish the vulnerability details on a public forum to warn other organizations.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A global manufacturing company is establishing a threat intelligence program. The company has a high risk of intellectual property theft from state-sponsored actors, a moderate risk of ransomware attacks, and a low risk of hacktivist activity. The program has limited resources and must prioritize its intelligence requirements. The board has requested strategic intelligence on long-term threats to the company's competitive advantage, while the SOC needs tactical indicators for immediate defense. Which prioritization approach best balances these competing needs?

   • ATreat all requirements equally to avoid alienating any stakeholder group.
   • BPrioritize ransomware indicators because they are more likely to occur and affect daily operations.
   • CFocus exclusively on state-sponsored IP theft because it poses the greatest risk to the company's competitive advantage.
   • DPrioritize state-sponsored IP theft as the top strategic requirement, while also allocating resources to tactical ransomware indicators for the SOC.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A financial services company is drafting the charter for its threat intelligence program. The program will collect data from external sources, including dark web forums, and will share intelligence with industry partners. The legal department is concerned about regulatory compliance and liability. The CISO wants the program to be agile and responsive to emerging threats. Which charter provision is most critical to include?

   • AA requirement that all intelligence products be approved by the legal department before dissemination.
   • BA detailed list of all threat actors and campaigns the program will monitor.
   • CA clear governance structure that defines decision-making authority, legal boundaries, and escalation paths for sensitive intelligence.
   • DA commitment to share all intelligence with industry partners to promote collective defense.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A threat intelligence team has identified a critical vulnerability in a widely used software product that affects the organization. The team needs to communicate this to various stakeholders, including the executive team, the IT operations team, and the legal department. The vulnerability is not yet publicly disclosed, and there is a risk of exploitation. What is the most appropriate communication approach?

   • APublish a detailed public advisory to warn other organizations about the vulnerability.
   • BIssue an urgent, confidential advisory to the IT operations team with technical details and immediate mitigation steps, and provide a high-level risk summary to the executive team and legal department.
   • CSend the same detailed technical report to all stakeholders, including the executive team and legal department.
   • DWait for the vendor to release a patch before informing any stakeholders.
   Reveal Solution Discussion Select an answer first