Threat Intelligence Program Requirements and Planning CTIA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An organization's risk management team is updating the enterprise risk register. The threat intelligence program has identified a new advanced persistent threat (APT) group targeting the organization's industry. How should the threat intelligence program contribute to the risk management process?

   • AShare the intelligence only with the SOC, since they are the ones who will respond.
   • BKeep the intelligence confidential to avoid alarming the risk team.
   • CProvide the risk team with intelligence on the APT's capabilities and intentions to inform risk ratings and mitigation strategies.
   • DWait until the APT is confirmed to have breached the organization before sharing information.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the primary purpose of developing a budget for a threat intelligence program?

   • ATo reduce the number of intelligence products produced
   • BTo justify the existence of the security team
   • CTo comply with tax regulations
   • DTo ensure that the program has adequate resources to achieve its objectives
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which cost is typically included in a threat intelligence program budget?

   • AThe cost of the organization's marketing campaigns
   • BThe cost of coffee in the office
   • CSalaries for threat intelligence analysts
   • DThe cost of office rent
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A new threat intelligence program is being established. The CISO states that the program's primary goal is to support strategic decisions about entering new markets. The SOC manager wants the program to provide tactical indicators for daily operations. How should the program manager define the program's goals and objectives?

   • ADefine a single broad goal that covers all possible needs.
   • BDefine both strategic and tactical goals, with specific objectives for each stakeholder group.
   • CFocus only on tactical goals, since they produce measurable results quickly.
   • DFocus only on strategic goals, since the CISO is the highest-ranking stakeholder.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which statement best defines a threat intelligence program?

   • AA set of ad-hoc activities performed by security analysts when a breach occurs
   • BA structured, ongoing effort to collect, analyze, and disseminate intelligence about threats to support organizational security decisions
   • CA one-time project to purchase and deploy threat intelligence feeds
   • DA regulatory compliance requirement that mandates specific threat data collection
   Reveal Solution Discussion Select an answer first