Types of Threat Intelligence (Strategic, Operational, Tactical, Technical) CTIA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A threat intelligence analyst is preparing a report that will be distributed to multiple audiences. The report must include a summary of the threat landscape for executives, a breakdown of recent attack campaigns for security managers, and a list of TTPs for SOC analysts. Which set of intelligence types should the analyst include?

   • AStrategic, operational, and tactical
   • BStrategic, tactical, and technical
   • COperational, tactical, and technical
   • DStrategic, operational, and technical
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A SOC team is overwhelmed by alerts from a recent malware campaign. The team has a list of IOCs from a commercial feed, but many alerts are false positives because the IOCs are too broad. The team lead wants to reduce false positives while still detecting the campaign. The team has access to a detailed analysis of the campaign's TTPs. Which approach is most effective?

   • AUse strategic threat intelligence to prioritize which alerts to investigate
   • BKeep the IOC alerts but add more IOCs from the TTP analysis
   • CRemove all IOC alerts and rely solely on the TTP analysis
   • DUse the TTP analysis to create behavior-based detection rules that complement the IOC alerts
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which type of threat intelligence is most likely to be presented to an organization's board of directors?

   • AOperational threat intelligence
   • BTechnical threat intelligence
   • CStrategic threat intelligence
   • DTactical threat intelligence
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What does operational threat intelligence primarily focus on?

   • AThreat actor capabilities, tools, and ongoing campaigns
   • BSpecific indicators like file hashes and IP addresses
   • CThe exact tactics, techniques, and procedures used in an attack
   • DThe motivations and goals of threat actors
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security engineer is evaluating two threat intelligence feeds. Feed A provides a high volume of IOCs but lacks context about the threat actors or their methods. Feed B provides detailed TTPs and campaign information but includes few IOCs. The engineer needs to improve the SIEM's detection capabilities while also enabling the SOC to understand the threats behind the alerts. Which approach is most effective?

   • AIntegrate Feed A for immediate detection and use Feed B to enrich alerts with context
   • BUse only Feed B because TTPs provide more valuable intelligence
   • CUse only Feed A because IOCs are directly actionable in the SIEM
   • DUse Feed A for the SIEM and discard Feed B because it is not machine-readable
   Reveal Solution Discussion Select an answer first