Threat Intelligence Program Requirements and Planning CTIA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A threat intelligence program is considering using data from a third-party source that collects information from peer-to-peer networks. The data includes IP addresses and timestamps of users who may be involved in malicious activity. The legal team has raised concerns about privacy laws and the potential for the data to include innocent users. The program's charter emphasizes compliance and ethical conduct. What is the best course of action?

   • AUse the data because it is available from a third party and the program has a legitimate security purpose.
   • BUse the data but only share it with law enforcement, not with other stakeholders.
   • CRefuse to use the data entirely, as any collection of personal information is unethical.
   • DConduct a legal and privacy impact assessment before using the data, and implement controls to minimize the handling of personal information.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which role in a threat intelligence team is responsible for overseeing the overall program and ensuring it meets its objectives?

   • AThreat intelligence manager
   • BThreat intelligence analyst
   • CThreat intelligence collector
   • DSecurity operations center (SOC) operator
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which legal consideration is most relevant when collecting threat intelligence from public sources?

   • AThe number of sources used
   • BThe language of the source material
   • CCopyright and terms of service of the sources
   • DThe speed of data collection
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A mid-sized technology company is planning a threat intelligence program. The budget is limited, and the company cannot afford a large team or expensive commercial threat intelligence platforms. The program will focus on monitoring threats to its cloud infrastructure and supporting incident response. Which resource planning approach is most appropriate?

   • APurchase an expensive commercial threat intelligence platform to automate collection and analysis, reducing the need for staff.
   • BHire a full team of collectors, analysts, and managers immediately to ensure comprehensive coverage.
   • COutsource the entire threat intelligence function to a managed security service provider.
   • DStart with a small team of two analysts using open-source tools and free threat feeds, and plan for gradual investment as the program matures.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A threat intelligence program is being evaluated by senior management. The program has produced many reports, but management is unsure if the program is worth the investment. The program's goals include reducing the impact of cyber incidents and improving the efficiency of the security team. Which set of KPIs would best demonstrate the program's value?

   • ANumber of IOCs collected, number of threat actors tracked, and number of intelligence products distributed.
   • BPercentage of stakeholders satisfied with reports, number of reports read, and number of meetings held.
   • CTime to detect and respond to incidents, percentage of incidents that were anticipated by intelligence, and cost savings from prevented incidents.
   • DNumber of reports produced, number of threat feeds subscribed to, and number of analysts on the team.
   Reveal Solution Discussion Select an answer first