Types of Threat Intelligence (Strategic, Operational, Tactical, Technical) CTIA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A CISO is preparing a presentation for the board of directors about the organization's cyber risk. The board is concerned about a recent industry-wide ransomware wave. The CISO has access to strategic reports, operational campaign analyses, and technical IOC feeds. Which combination of intelligence should the CISO use to address the board's concern most effectively?

   • AOperational analyses to describe the campaigns and technical IOC feeds to show the scale.
   • BStrategic reports only, because the board does not need operational details.
   • CStrategic reports to explain the business impact and operational analyses to describe the threat landscape.
   • DTechnical IOC feeds to show the specific indicators and strategic reports to summarize them.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary audience for technical threat intelligence?

   • ALegal and compliance teams
   • BExecutive leadership
   • CTechnical staff such as SOC analysts and engineers
   • DSecurity managers
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary use of strategic threat intelligence?

   • ATo guide high-level decisions about risk management and resource allocation
   • BTo detail the specific malware families used by a threat actor
   • CTo provide step-by-step incident response procedures
   • DTo identify specific IP addresses to block at the firewall
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A cybersecurity consulting firm is preparing a threat intelligence report for a client. The report must include an overview of the geopolitical tensions that could affect the client's industry, the likely threat actors, and the potential business impact. The client's executives will use this report to guide risk management decisions. Which type of threat intelligence should be the primary focus of this report?

   • AOperational threat intelligence
   • BStrategic threat intelligence
   • CTechnical threat intelligence
   • DTactical threat intelligence
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A threat intelligence platform (TIP) is being configured to distribute intelligence to different teams. The SOC analysts need information that helps them identify attacker behavior patterns and adjust their hunting queries. The executive team needs a quarterly risk summary. The security engineering team needs a list of malicious domains to block. Which combination of intelligence types should the TIP deliver to each team?

   • AOperational to SOC analysts, technical to executives, strategic to security engineers
   • BStrategic to SOC analysts, tactical to executives, operational to security engineers
   • CTechnical to SOC analysts, operational to executives, tactical to security engineers
   • DTactical to SOC analysts, strategic to executives, technical to security engineers
   Reveal Solution Discussion Select an answer first