Threat Intelligence Program Requirements and Planning CTIA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which element is typically included in a threat intelligence program charter?

   • ASpecific malware signatures to block
   • BThe daily shift schedule for analysts
   • CThe program's mission and objectives
   • DThe names of all threat intelligence vendors
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A threat intelligence program has been operating for six months. The CISO asks the program manager to demonstrate the program's value. The team has been producing weekly reports and tracking the number of indicators collected. Which metric would best demonstrate the program's effectiveness?

   • AThe total number of indicators collected from all sources.
   • BThe number of weekly reports produced without errors.
   • CThe number of threat actors identified by name.
   • DThe percentage of intelligence reports that led to a change in security controls or risk decisions.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team is selecting tools for its new threat intelligence program. The team needs to collect data from multiple sources, correlate indicators, and produce reports for different audiences. The budget is moderate, and the team has limited scripting skills. Which tool selection approach best fits these constraints?

   • APurchase separate best-of-breed tools for collection, analysis, and reporting and integrate them manually.
   • BBuild a custom collection and analysis pipeline using open-source scripts and a database.
   • CChoose an integrated threat intelligence platform that provides collection, analysis, and reporting in one product.
   • DUse a single free tool for everything, even if it lacks reporting features.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of defining Key Performance Indicators (KPIs) for a threat intelligence program?

   • ATo measure the effectiveness and value of the program
   • BTo replace the need for regular reporting
   • CTo automate the collection of threat data
   • DTo determine the exact number of threats in the wild
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial institution's threat intelligence team has collected more intelligence requirements than it can handle with current resources. The requirements include: tracking a known ransomware gang targeting the sector, monitoring hacktivist groups that have threatened the company's brand, and analyzing a new exploit for a legacy system that is scheduled for decommissioning next quarter. Which requirement should receive the highest priority?

   • AAll requirements equally, because each stakeholder's need is valid and should be addressed.
   • BThe legacy system exploit, because the system is still in production and any vulnerability is critical.
   • CThe ransomware gang, because it poses a direct and imminent financial and operational risk to the organization.
   • DThe hacktivist groups, because brand damage can affect customer trust and stock price.
   Reveal Solution Discussion Select an answer first