Threat Intelligence Program Requirements and Planning CTIA Practice Questions (Page 12)

Questions 56–60

1. 56expert · hard

   A multinational corporation is designing its threat intelligence team. The team must serve stakeholders in different time zones and provide intelligence to both technical and non-technical audiences. The team currently has five analysts with varying levels of experience. Which team structure and workflow design best meets these needs?

   • ACreate a single team that works standard business hours and produces one standardized report for all stakeholders.
   • BOrganize analysts into functional roles (collector, analyst, reporter) and establish a follow-the-sun workflow to ensure coverage across time zones.
   • CHire additional analysts to create separate teams for each stakeholder group.
   • DHave each analyst handle all tasks for a specific region, from collection to reporting.
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   How does threat intelligence integrate with organizational risk management?

   • ABy eliminating the need for security controls
   • BBy replacing the need for risk assessments
   • CBy providing information that helps identify and assess risks
   • DBy automatically mitigating all identified risks
   Reveal Solution Discussion Select an answer first
4. 58foundation · easy

   In a threat intelligence team, what is the primary responsibility of an intelligence analyst?

   • ATo analyze data and produce intelligence products
   • BTo collect raw data from external sources
   • CTo approve the program's budget
   • DTo manage the team's daily operations
   Reveal Solution Discussion Select an answer first
5. 59application · medium

   A financial services firm is designing its threat intelligence team. The team will include a manager, two analysts, and a collector. The manager is responsible for setting priorities and communicating with executives. The analysts will produce intelligence products, and the collector will gather raw data from open and closed sources. What additional role is most needed to ensure the team operates effectively?

   • AA penetration tester to validate the intelligence findings by simulating attacks.
   • BA data scientist to build machine learning models for automated threat detection.
   • CA dissemination officer to ensure intelligence products reach the right stakeholders in a timely manner.
   • DA legal advisor to review all intelligence products for compliance before release.
   Reveal Solution Discussion Select an answer first
6. 60foundation · easy

   Which workflow step comes immediately after intelligence collection?

   • AProcessing
   • BFeedback
   • CRequirements definition
   • DDissemination
   Reveal Solution Discussion Select an answer first