Types of Threat Intelligence (Strategic, Operational, Tactical, Technical) CTIA Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   Which type of threat intelligence is primarily consumed by security analysts to understand how an attacker operates?

   • AStrategic threat intelligence
   • BOperational threat intelligence
   • CTechnical threat intelligence
   • DTactical threat intelligence
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A CISO is preparing a report for the board that must explain the company's exposure to a newly discovered APT group. The board wants to know the potential impact on the company's operations and what investments are needed to mitigate the risk. The CISO has access to a detailed operational intelligence report about the APT group's campaigns and a technical report with IOCs. Which approach best meets the board's needs?

   • APresent the technical report with IOCs to show the board the specific indicators
   • BPresent the operational report as-is, focusing on the APT group's tactics and campaigns
   • CProvide the board with both the operational and technical reports and let them draw conclusions
   • DSynthesize the operational report into a strategic narrative that highlights business impact and recommended investments
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which audience is the primary consumer of operational threat intelligence?

   • AIncident responders
   • BSecurity managers
   • CNetwork administrators
   • DChief executive officers
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A threat intelligence team is tasked with producing a report that will be used by three different audiences: executives, security managers, and security analysts. The report must cover the business impact of a new threat, the campaign patterns, and the specific TTPs. The team has limited time and must produce a single report. Which structure best serves all three audiences?

   • ACombine all three types into a single technical section.
   • BProvide only the tactical TTPs, because analysts are the primary audience.
   • CStart with a strategic executive summary, then provide operational campaign details, and finish with tactical TTPs.
   • DProvide only the strategic summary, because it covers the business impact.
   Reveal Solution Discussion Select an answer first