Threat Intelligence Program Requirements and Planning CTIA Practice Questions (Page 13)

Questions 61–65

1. 61application · medium

   A large enterprise is designing its threat intelligence team. The team will need to collect data from multiple sources, analyze it to produce actionable intelligence, and deliver reports to executives and the SOC. The team currently has three analysts with general skills. Which team structure would best meet these needs?

   • AHave all three analysts perform every role interchangeably, with no defined responsibilities.
   • BHire a dedicated manager and two additional analysts to separate collection, analysis, and reporting into distinct teams.
   • COutsource the collection function to a vendor and keep the analysts focused on analysis and reporting.
   • DAssign one analyst as the primary collector, one as the primary analyst, and one as the primary reporter, with cross-training to cover absences.
   Reveal Solution Discussion Select an answer first
2. 62application · medium

   A security team is selecting tools for its threat intelligence program. The team needs to collect indicators from open-source feeds, analyze them for relevance, and automatically share finished reports with the SOC and executive team. Which tool selection strategy best supports these requirements?

   • ABuild a custom collection script and rely on manual analysis and reporting.
   • BUse a standalone malware sandbox for analysis and a separate email tool for reporting.
   • CSelect a commercial threat feed service that provides finished reports directly to stakeholders.
   • DChoose an open-source threat intelligence platform that supports feed ingestion, analysis workflows, and report generation.
   Reveal Solution Discussion Select an answer first
4. 63foundation · easy

   Which method is commonly used to collect and document intelligence requirements from stakeholders?

   • AAutomated vulnerability scanning
   • BPenetration testing
   • CNetwork traffic analysis
   • DInterviews and structured questionnaires
   Reveal Solution Discussion Select an answer first
5. 64foundation · easy

   What is the purpose of establishing a continuous improvement process for a threat intelligence program?

   • ATo ensure the program adapts to changing threats and stakeholder needs
   • BTo automate all intelligence analysis
   • CTo reduce the number of intelligence reports produced
   • DTo eliminate the need for stakeholder feedback
   Reveal Solution Discussion Select an answer first
6. 65application · medium

   A mid-sized company is planning a new threat intelligence program. The budget is limited, and the CISO wants to hire two analysts and purchase a commercial threat intelligence platform. The security team currently has no dedicated intelligence staff. What is the most important resource consideration during the planning phase?

   • ADeferring all resource planning until after the program charter is approved.
   • BEnsuring the budget covers not only salaries and software licenses but also training, data feeds, and ongoing operational costs.
   • CSelecting the most expensive threat intelligence platform to ensure the best coverage.
   • DHiring senior analysts with deep expertise, even if it means only one analyst can be afforded.
   Reveal Solution Discussion Select an answer first