Threat Intelligence Program Requirements and Planning CTIA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the purpose of a threat intelligence program charter?

   • ATo define the program's scope, authority, and governance structure
   • BTo list all the threat actors that the program will monitor
   • CTo serve as a marketing document for the security team
   • DTo provide detailed technical procedures for analysts
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A startup is creating a threat intelligence program with a limited budget. The team needs to collect threat data, analyze it, and produce reports. They are considering a commercial platform, but the cost is high. What is the most cost-effective approach that still meets the program's needs?

   • AUse only free threat feeds and avoid any analysis tools to minimize costs.
   • BPurchase the commercial platform immediately to ensure the program is robust from day one.
   • CStart with open-source tools and free threat feeds, then upgrade to a commercial platform as the program matures.
   • DHire additional analysts instead of purchasing any tools, relying on manual analysis.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A global company is establishing a threat intelligence program. The program will collect data from sources in multiple countries, including some with strict data privacy laws. The legal team is concerned about cross-border data transfers. The CISO wants the program to be able to share intelligence with subsidiaries worldwide. What is the most appropriate way to address this in the program charter?

   • AProhibit all cross-border data transfers to avoid legal issues.
   • BDefine data classification and handling rules that comply with applicable privacy regulations and establish approved sharing mechanisms.
   • CStore all intelligence data in a single country and require all subsidiaries to access it remotely.
   • DInclude a clause that the program will comply with the laws of the country where the data is collected.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary role of the Chief Information Security Officer (CISO) as a stakeholder in a threat intelligence program?

   • ATo collect raw threat data from external sources
   • BTo provide strategic direction and ensure the program aligns with business objectives
   • CTo manually analyze every threat alert
   • DTo approve every intelligence report before dissemination
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A healthcare organization is drafting the charter for its new threat intelligence program. The program will collect data from open sources, industry sharing groups, and internal telemetry. The legal department has raised concerns about privacy regulations and data sharing agreements. Which element is most important to include in the charter to address these concerns?

   • AA clear statement of the program's authority to collect, analyze, and share intelligence within legal boundaries.
   • BA detailed list of the specific threat actors the program will monitor.
   • CA description of the technical tools the program will use for data collection.
   • DA budget breakdown for the first year of operation.
   Reveal Solution Discussion Select an answer first