A security team is selecting tools for its threat intelligence program. The team needs to collect data from a variety of sources, including commercial feeds, open-source feeds, and internal telemetry. The team also needs to automate the dissemination of intelligence to the SIEM and ticketing system. The budget is constrained, and the team has limited integration expertise. Which tool selection approach is most appropriate?

Choose a commercial threat intelligence platform that offers built-in integrations with the SIEM and ticketing system, despite the higher cost.

Use an open-source platform and develop custom scripts to integrate with the SIEM and ticketing system.

Use separate tools for collection, analysis, and dissemination, and manually transfer data between them.

Select a tool based solely on its collection capabilities, and plan to address analysis and dissemination later.

In the intelligence process, what is the primary purpose of the 'processing' phase?

To collect raw data from various sources

To transform raw data into a format suitable for analysis

To define intelligence requirements

To disseminate intelligence to stakeholders

What is the primary purpose of a reporting and communication plan in a threat intelligence program?

To collect raw data from external sources

To ensure that intelligence products are delivered to the right stakeholders in a timely and useful manner

To store intelligence data in a secure database

To automate the analysis of threat data

What is the purpose of gathering intelligence requirements from stakeholders?

To comply with regulatory mandates for threat intelligence

To justify the budget for the threat intelligence program

To ensure the program produces intelligence that is relevant and useful to decision-makers

To identify which security tools to purchase

When prioritizing intelligence requirements, which factor should be given the most weight?

The potential impact on the organization if the requirement is not met

The ease of collecting data to satisfy the requirement

The number of stakeholders who request the requirement

The personal interest of the intelligence analysts

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 3Objective 1

Threat Intelligence Program Requirements and Planning CTIA Practice Questions (Page 11)

Part of the Requirements, Planning and Direction domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 68 practice questions to prepare you well beyond it. (estimate)

68questions here

14free pages

16concepts

16 Concepts in This Objective

Threat Intelligence Program Definition
Program Goals and Objectives
Stakeholder Identification
Requirements Gathering
Intelligence Requirements Prioritization
Program Scope and Charter
Resource Planning
Team Structure and Roles
Tool and Technology Selection
Process and Workflow Design
Metrics and Performance Measurement
Reporting and Communication Plan
Legal and Ethical Considerations
Budget and Cost Management
Risk Management Integration
Continuous Improvement

Questions 51–55

51expert · hard
A security team is selecting tools for its threat intelligence program. The team needs to collect data from a variety of sources, including commercial feeds, open-source feeds, and internal telemetry. The team also needs to automate the dissemination of intelligence to the SIEM and ticketing system. The budget is constrained, and the team has limited integration expertise. Which tool selection approach is most appropriate?
Select an answer first
52foundation · easy
In the intelligence process, what is the primary purpose of the 'processing' phase?
Select an answer first
53foundation · easy
What is the primary purpose of a reporting and communication plan in a threat intelligence program?
Select an answer first
54foundation · easy
What is the purpose of gathering intelligence requirements from stakeholders?
Select an answer first
55foundation · easy
When prioritizing intelligence requirements, which factor should be given the most weight?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.