Types of Threat Intelligence (Strategic, Operational, Tactical, Technical) CTIA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is building a threat intelligence program from scratch. The program's goal is to support both executive decision-making and day-to-day security operations. The team has limited resources and must prioritize which intelligence types to develop first. Which approach best balances the needs of both audiences?

   • ADevelop all four types simultaneously with equal resources
   • BStart with technical and tactical intelligence to support immediate detection, then add operational and strategic intelligence as the program matures
   • CStart with strategic intelligence to get executive buy-in, then develop the other types later
   • DFocus only on operational intelligence because it bridges the gap between executives and analysts
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SOC analyst is overwhelmed by the number of alerts generated from a commercial IOC feed. The analyst wants to reduce noise while still detecting real threats. The analyst has access to operational intelligence that describes which threat actors are actively targeting the organization's industry. Which approach best reduces false positives?

   • AUse the IOC feed only for blocking and not for alerting.
   • BDisable the IOC feed and rely on tactical intelligence for detection.
   • CFilter the IOC feed to only include indicators associated with threat actors that target the organization's industry.
   • DIncrease the severity threshold for all IOC alerts.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security operations manager is deciding how to allocate the team's time between two intelligence sources. Source A provides detailed TTPs for known malware families. Source B provides information about ongoing campaigns and the threat actors behind them. The manager's goal is to improve the organization's ability to anticipate and respond to new attacks. Which source should the manager prioritize?

   • ASource A, because detailed TTPs are directly actionable for detection.
   • BNeither source, because the team should focus on technical IOC feeds instead.
   • CBoth sources equally, because they provide complementary information.
   • DSource B, because understanding campaigns and actors helps anticipate future attacks.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security manager at a mid-sized company is deciding whether to invest in a new threat intelligence platform. The manager needs to justify the investment to the CFO by showing how the platform will help the company understand the specific threat actors that target their industry and how those actors operate. The CFO is not technical and wants a clear link between threat intelligence and business risk. Which approach best satisfies both the manager's and the CFO's needs?

   • AUse operational threat intelligence to identify relevant threat actors and campaigns, and present a strategic summary to the CFO that links these threats to business risk
   • BUse strategic threat intelligence only, and have the manager infer the operational details from the strategic report
   • CUse tactical threat intelligence to identify specific TTPs and present the same technical details to the CFO
   • DUse technical threat intelligence to collect IOCs and present a list of indicators to the CFO
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which statement correctly compares strategic and tactical threat intelligence?

   • ABoth focus on indicators of compromise
   • BStrategic intelligence is detailed and technical; tactical intelligence is high-level and business-focused
   • CBoth are used for immediate incident response decisions
   • DStrategic intelligence is for executives and focuses on long-term risk; tactical intelligence is for analysts and focuses on TTPs
   Reveal Solution Discussion Select an answer first