Threat Intelligence Program Requirements and Planning CTIA Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A threat intelligence program has been running for a year. The team notices that some stakeholders no longer read the weekly reports, and the SOC has started ignoring certain intelligence alerts. What is the best way to address this and improve the program?

   • AEscalate the issue to the CISO and request that stakeholders be mandated to read the reports.
   • BIncrease the frequency of reports to ensure stakeholders receive more information.
   • CStop producing reports and focus only on technical indicators for the SOC.
   • DConduct a stakeholder feedback survey to understand why the reports are not useful and adjust the reporting format and content accordingly.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A threat intelligence analyst is considering using a new data source that provides real-time telemetry from compromised devices. The source is not officially authorized by the organization, and the data may contain personal information of individuals. What should the analyst do?

   • AUse the source because it provides valuable intelligence that could prevent attacks.
   • BAvoid using the source until legal and compliance teams have reviewed its use and data handling.
   • CAsk the vendor for a written guarantee that the data is legal to use.
   • DUse the source but anonymize all personal data before analysis.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which activity is part of a continuous improvement process for a threat intelligence program?

   • AConducting periodic reviews of intelligence products and processes
   • BPurchasing the latest security tools every month
   • CIncreasing the number of threat feeds without evaluation
   • DDecreasing the frequency of stakeholder communication
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A healthcare organization is defining its threat intelligence requirements. Stakeholders submit the following needs: (1) track ransomware gangs targeting the sector, (2) monitor hacktivist groups protesting the organization's research, (3) collect indicators of compromise for a new malware family seen in the wild, and (4) analyze geopolitical events that could disrupt supply chain partners. The organization has limited analyst time. Which requirement should receive the highest priority?

   • AGeopolitical events affecting supply chain partners, because they could have a broad indirect impact.
   • BHacktivist groups protesting the organization's research, because they could cause reputational damage.
   • CIndicators of compromise for the new malware family, because they are concrete and easy to collect.
   • DRansomware gangs targeting the healthcare sector, because a successful attack could disrupt patient care and cause regulatory penalties.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A threat intelligence program has been running for two years. The team conducts annual stakeholder surveys, but the response rate is low and the feedback is vague. The CISO wants to improve the program's alignment with organizational needs. Which approach would most effectively drive continuous improvement?

   • ACompare the program's metrics to industry benchmarks and adjust based on those comparisons.
   • BEstablish a quarterly review process with each stakeholder group to discuss the usefulness of intelligence products and adjust priorities.
   • CIncrease the number of reports produced to ensure stakeholders have more information.
   • DRely on the annual survey results, even if the response rate is low.
   Reveal Solution Discussion Select an answer first