I85PREP
⌘ K
CTIA study materials
CTIA study resources

CTIA practice questions

One question at a time. Build your CTIA understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Threat-intelligence requirements, collection and dissemination

An organization wants to understand the geopolitical motivations of state-aligned actors targeting its sector. Which collection discipline is most relevant?

  1. OSINT - open-source intelligence including academic, news, and government sources Correct answer.
  2. MASINT - measurement and signature intelligence
  3. GEOINT - geospatial imagery
  4. FININT - financial intelligence only

Explanation

Geopolitical motivation analysis draws heavily on OSINT - government statements, sanctions lists, academic research, news, think-tank publications, and open court records. Commercial CTI vendors and ISACs amplify OSINT with their own analysis.

Question 2Threat-intelligence requirements, collection and dissemination

Which collection discipline involves obtaining intelligence from human sources, such as informants on dark-web forums?

  1. OSINT
  2. HUMINT Correct answer.
  3. SIGINT
  4. GEOINT

Explanation

HUMINT (Human Intelligence) is gathered through interaction with human sources - interviews, informants, undercover personas, or relationships built on closed forums. In CTI, vendors like Flashpoint and Recorded Future operate cyber-HUMINT programs in criminal communities.

Question 3Threat-intelligence requirements, collection and dissemination

Which collection discipline includes intercepted communications such as network traffic captures, decrypted protocols, and electronic emissions?

  1. OSINT
  2. HUMINT
  3. SIGINT Correct answer.
  4. FININT

Explanation

SIGINT (Signals Intelligence) covers communications intelligence (COMINT) and electronic intelligence (ELINT). In commercial CTI, network telemetry, NetFlow, passive DNS, and packet capture serve SIGINT-like functions for adversary tracking.

Question 4Threat-intelligence requirements, collection and dissemination

An analyst wants to enrich a suspicious IP address with passive DNS history, WHOIS data, geolocation, and ASN ownership. Which type of collection is this?

  1. Active scanning of the suspicious IP
  2. Passive enrichment using third-party intelligence sources Correct answer.
  3. Phishing the IP owner
  4. Submitting an FBI subpoena

Explanation

Passive enrichment uses pre-collected datasets (passive DNS like Farsight DNSDB, WHOIS history, MaxMind geolocation, RIR ASN data) to add context without interacting with adversary infrastructure. Active scanning could tip off the adversary that they have been detected.

Question 5Threat-intelligence requirements, collection and dissemination

Which characteristic distinguishes a commercial premium threat feed from open-source feeds?

  1. Commercial feeds are always 100% accurate
  2. Commercial feeds typically offer curated indicators with confidence scoring, context, and SLAs, while open feeds vary widely in quality Correct answer.
  3. Open-source feeds have no false positives
  4. Commercial feeds never include malware hashes

Explanation

Premium feeds add value through curation, contextual metadata (campaign attribution, kill-chain mapping), confidence scores, dedup, freshness SLAs, and analyst support. Open feeds (e.g., Abuse.ch URLhaus, OTX) are valuable but require more local triage.

Question 6Threat-intelligence requirements, collection and dissemination

When ingesting bulk threat data, which processing step removes duplicate indicators that arrived from multiple feeds?

  1. Deduplication Correct answer.
  2. Encryption
  3. Sandbox detonation
  4. Reverse engineering

Explanation

Deduplication compares indicators across feeds and consolidates them, often retaining the highest-confidence source while preserving sightings/source metadata. Without dedup, downstream tools can be flooded with redundant alerts and analysts wastes cycles re-investigating.

Question 7Threat-intelligence requirements, collection and dissemination

What does normalization of threat data accomplish?

  1. Compresses data to reduce storage
  2. Converts data from heterogeneous feed formats into a common schema (e.g., STIX, OpenIOC) Correct answer.
  3. Encrypts indicators in transit
  4. Removes all false positives automatically

Explanation

Normalization translates feeds delivered in CSV, JSON, XML, MISP, or vendor-specific formats into a common schema so they can be correlated, queried, and shared. STIX 2.1 is the prevailing target format. Normalization is a prerequisite for meaningful enrichment and analysis.

Question 8Threat-intelligence requirements, collection and dissemination

An analyst writes a Python script to pull IOCs from MISP via its REST API and push them into the SIEM. Which CTIA-relevant skill area does this represent?

  1. Threat hunting only
  2. Automation of threat intelligence collection and integration through scripting Correct answer.
  3. Reverse engineering
  4. Penetration testing

Explanation

The CTIA blueprint includes Python scripting for automating collection, sharing, and integration tasks. PyMISP is a common library for MISP automation; STIX libraries (stix2) and TAXII clients (taxii2-client) further automate sharing and ingestion.

Question 9Threat-intelligence requirements, collection and dissemination

Which type of malware analysis runs the sample in an isolated environment to observe behavior?

  1. Static analysis
  2. Dynamic analysis (sandboxing) Correct answer.
  3. Code review
  4. Linting

Explanation

Dynamic analysis detonates the sample in an instrumented sandbox (Cuckoo, Joe Sandbox, ANY.RUN, Hatching Triage) to capture process activity, file system changes, registry edits, and network calls. CTI uses dynamic analysis to extract behavioral IOCs and TTPs.

Question 10Threat-intelligence requirements, collection and dissemination

Which section of a Windows PE file's header is most useful for static malware analysis to identify imported APIs?

  1. DOS stub
  2. Import Address Table (IAT) / Import Directory Correct answer.
  3. Resource section
  4. Overlay

Explanation

The Import Address Table lists DLLs and functions the binary calls at runtime. Suspicious imports (CreateRemoteThread, VirtualAllocEx, WriteProcessMemory) suggest process injection; CryptEncrypt with file APIs may indicate ransomware. IAT analysis is a foundational static-analysis step.

Question 11Threat-intelligence requirements, collection and dissemination

Cyber Counterintelligence (CCI) in CTI primarily focuses on what?

  1. Building offensive capabilities
  2. Identifying, deceiving, and disrupting adversary collection efforts against the organization Correct answer.
  3. Patching vulnerabilities
  4. Writing user awareness training

Explanation

CCI defends against adversary intelligence collection. Activities include monitoring for credential leaks, deploying canary tokens and honeypots, detecting reconnaissance against the brand, and producing strategic deception. CCI complements but is distinct from offensive operations.

Question 12Threat-intelligence requirements, collection and dissemination

When collecting threat data in a cloud environment, which AWS service log is the BEST source for identifying suspicious API calls and account compromises?

  1. S3 access logs
  2. AWS CloudTrail Correct answer.
  3. VPC Flow Logs
  4. Route 53 query logs

Explanation

CloudTrail records every AWS API call (who, when, from where, on what resource). It is the primary log for detecting unauthorized IAM activity, privilege escalation, persistence (new access keys, lambda functions), and exfiltration via API. Cloud CTI must enrich findings with CloudTrail telemetry.

Question 13Threat-intelligence requirements, collection and dissemination

What is data sampling, and when is it used in threat data processing?

  1. Selecting a representative subset of data when full processing is infeasible due to volume Correct answer.
  2. Encrypting data at rest
  3. Replicating data across regions for high availability
  4. Deleting old data after retention expires

Explanation

Data sampling is used when full analysis of high-volume telemetry (NetFlow, DNS logs, EDR events) is impractical. Random or stratified sampling provides statistically representative views for trend analysis. Care must be taken: sampling can miss low-frequency, high-impact events.

Question 14Threat-intelligence requirements, collection and dissemination

Which TLP (Traffic Light Protocol) marking permits unrestricted disclosure?

  1. TLP:RED
  2. TLP:AMBER
  3. TLP:GREEN
  4. TLP:CLEAR (formerly TLP:WHITE) Correct answer.

Explanation

TLP:CLEAR (renamed from TLP:WHITE in TLP 2.0) permits unrestricted disclosure. RED is recipients-only, AMBER limits to recipients' organization (with optional +STRICT), and GREEN allows community-wide sharing within trusted communities.

Question 15Threat-intelligence requirements, collection and dissemination

Which automated processing technique enriches an IOC by querying multiple external services in parallel and merging the results?

  1. Indicator pivoting
  2. Indicator enrichment via API orchestration Correct answer.
  3. Indicator deletion
  4. Indicator obfuscation

Explanation

Enrichment orchestration calls VirusTotal, GreyNoise, Shodan, AbuseIPDB, passive DNS, and TIPs in parallel, then merges responses to produce a single contextual record. SOAR platforms (Cortex XSOAR, Splunk SOAR, Tines) commonly automate this pattern for analyst review.

Question 16Threat-intelligence requirements, collection and dissemination

An analyst is structuring raw collected data into rows of indicator, type, source, first-seen, last-seen, confidence, and context. Which processing step is this?

  1. Deletion
  2. Structuring/normalization for storage and querying Correct answer.
  3. Sandbox detonation
  4. Public disclosure

Explanation

Imposing a consistent record schema is structuring (or normalization). It enables relational or graph storage, efficient querying, and downstream sharing. CTIA Domain 4 emphasizes data structuring as a prerequisite for analysis.

Question 17Threat-intelligence requirements, collection and dissemination

Which is a key consideration when storing collected threat data?

  1. Make it publicly readable to maximize transparency
  2. Apply role-based access control, encryption, retention policies aligned to TLP/data classification, and audit logging Correct answer.
  3. Delete everything weekly
  4. Store on personal USB drives

Explanation

Threat data may contain sensitive material (TLP:RED, victim names, undisclosed vulnerabilities). RBAC limits who sees what, encryption protects at rest/in transit, retention aligns with sharing agreements and regulation, and audit logs support accountability.

Question 18Threat-intelligence requirements, collection and dissemination

Which Python library provides a high-level client for interacting with a MISP instance via its API?

  1. PyMISP Correct answer.
  2. Pillow
  3. Requests-OAuth
  4. Pandas

Explanation

PyMISP is the official MISP project Python client. It supports event creation, attribute management, sightings, taxonomies, galaxies, and bulk import/export - the standard tool for MISP automation in CTIA Domain 4 and 6 use cases.

Question 19Threat-intelligence requirements, collection and dissemination

What is 'threat data enrichment' performed in a cloud environment, and why is it valuable?

  1. Adding cloud-context attributes (account ID, region, principal, tags) to indicators so cloud defenders can act with full context Correct answer.
  2. Decrypting customer data without authorization
  3. Disabling cloud-native logging
  4. Sharing root credentials with vendors

Explanation

Cloud enrichment ties an indicator to specific cloud context: which AWS account, which region, which IAM principal, which workload tag. Without this, an indicator like 'suspicious access key used' is meaningless. CTIA v2 emphasizes cloud-aware enrichment.

Question 20Threat-intelligence requirements, collection and dissemination

Which collection method is generally LEAST appropriate for a commercial CTI program due to legal and ethical constraints?

  1. Aggregating publicly available OSINT
  2. Active offensive operations against suspected adversary infrastructure (hack-back) Correct answer.
  3. Subscribing to commercial feeds
  4. Monitoring open dark-web forums

Explanation

'Hack-back' (offensive action against attacker infrastructure) is illegal in most jurisdictions and risks misattribution, collateral damage, and escalation. Commercial CTI relies on lawful collection - OSINT, feeds, dark-web monitoring, partnerships, sinkhole data sharing, and HUMINT.

Question 21Threat models, structured sharing and evidence-based hunting

When analyzing collected threat data, what is contextualization?

  1. Removing all metadata to reduce file size
  2. Adding metadata, relationships, and analyst commentary so each indicator's significance is clear Correct answer.
  3. Encrypting data with AES-256
  4. Converting to JPEG format

Explanation

Contextualization gives an indicator meaning: which campaign or actor it ties to, when it was observed, what malware family used it, what kill-chain phase, and why a defender should care. Indicators without context are noise and produce alert fatigue.

Question 22Threat models, structured sharing and evidence-based hunting

Which type of data analysis uses statistical methods to detect outliers, baselines, and trends across telemetry?

  1. Statistical analysis Correct answer.
  2. Static binary analysis
  3. Reverse engineering
  4. Open-source research

Explanation

Statistical analysis applies mean, standard deviation, percentiles, and time-series methods to telemetry (logon counts, DNS volumes, beacon intervals) to surface anomalies. Beyond outliers, statistical scoring supports prioritization and confidence assignment.

Question 23Threat models, structured sharing and evidence-based hunting

What is Analysis of Competing Hypotheses (ACH) and who developed it?

  1. A technique by Richards Heuer that lists hypotheses and evaluates each piece of evidence against all of them to find the least-disconfirmed hypothesis Correct answer.
  2. A statistical regression method developed by IBM
  3. A penetration testing methodology developed by Offensive Security
  4. A cryptographic protocol from NIST

Explanation

ACH was developed by CIA analyst Richards J. Heuer in his 'Psychology of Intelligence Analysis.' Analysts list all reasonable hypotheses, score each evidence item as Consistent/Inconsistent/Not Applicable for each hypothesis, and select the hypothesis with the fewest inconsistencies. ACH counters confirmation bias.

Question 24Threat models, structured sharing and evidence-based hunting

An analyst applies the threat analysis process and assesses an indicator's confidence as 'highly likely' attribution to APT29. Which scale standardizes such verbal probability terms?

  1. ICD 203 / Words of Estimative Probability (WEPs) Correct answer.
  2. OWASP Top 10
  3. CVE numbering
  4. ISO 27001 Annex A

Explanation

ICD (Intelligence Community Directive) 203 standardizes Words of Estimative Probability - almost no chance, very unlikely, unlikely, roughly even chance, likely, very likely, almost certain - each tied to numeric probability ranges. Using consistent WEPs prevents miscommunication of confidence.

Question 25Threat models, structured sharing and evidence-based hunting

Which cognitive bias most threatens an analyst who already believes 'APT28 is behind this' and selectively interprets evidence to support that view?

  1. Confirmation bias Correct answer.
  2. Anchoring bias
  3. Availability heuristic
  4. Survivorship bias

Explanation

Confirmation bias is the tendency to seek and weigh evidence that supports existing beliefs while discounting contradictory data. ACH, structured analytic techniques (SATs), and red-teaming hypotheses are countermeasures. CTIA Domain 5 expects analysts to recognize and mitigate cognitive bias.

Question 26Threat models, structured sharing and evidence-based hunting

In the threat analysis process, what is the purpose of fine-tuning?

  1. Adjusting analytical models, weighting, and detection rules based on feedback to reduce false positives and improve accuracy Correct answer.
  2. Recompiling malware samples
  3. Encrypting analyst notebooks
  4. Replacing all human analysts with AI

Explanation

Fine-tuning is iterative refinement of analytic outputs - adjusting confidence thresholds, retiring noisy indicators, recalibrating clustering rules, and updating detection logic based on operator feedback. This continuous improvement closes the lifecycle's feedback loop.

Question 27Threat models, structured sharing and evidence-based hunting

Which open-source platform is widely used as a knowledge base for storing structured threat intelligence and supports linking observables, indicators, and intrusion sets via STIX 2.1?

  1. OpenCTI Correct answer.
  2. Wireshark
  3. Burp Suite
  4. Nessus

Explanation

OpenCTI (by Filigran/ANSSI) is an open-source CTI knowledge management platform built around STIX 2.1. It supports SDOs (intrusion-set, threat-actor, malware), relationships, taxonomies, and connectors for MISP, AlienVault OTX, Shodan, and more.

Question 28Threat models, structured sharing and evidence-based hunting

What is the purpose of building runbooks and a knowledge base in a CTI program?

  1. Decorate analyst office walls
  2. Capture repeatable analytic procedures, lessons learned, and reference data so quality persists across staff turnover Correct answer.
  3. Replace SIEM with Word documents
  4. Impress auditors only

Explanation

Runbooks document step-by-step analytic procedures (e.g., 'investigate suspicious domain'), and the knowledge base preserves campaign reports, actor profiles, and prior analyses. Together they ensure consistent quality, faster onboarding, and institutional memory beyond individual analysts.

Question 29Threat models, structured sharing and evidence-based hunting

An analyst correlates a phishing domain, a malware hash, and a C2 IP, then groups them as belonging to the same campaign. Which analytic technique is this?

  1. Indicator clustering / linkage analysis Correct answer.
  2. Vulnerability scoring
  3. Compliance auditing
  4. Penetration testing

Explanation

Linkage analysis (also called clustering) groups related observables into intrusion sets or campaigns by shared infrastructure, code reuse, timing, or victimology. Tools like Maltego and OpenCTI visualize these relationships to support campaign tracking.

Question 30Threat models, structured sharing and evidence-based hunting

Which data-analysis technique is most appropriate when an analyst has a hypothesis and wants to test it against quantitative evidence?

  1. Hypothesis-driven statistical validation Correct answer.
  2. Random keyword search of the internet
  3. Asking ChatGPT and stopping there
  4. Ignoring the hypothesis

Explanation

Hypothesis-driven validation defines measurable predictions of the hypothesis and tests them against telemetry or threat data using statistical methods (significance testing, confidence intervals). This rigorous approach reduces speculative reasoning.

Question 31Threat models, structured sharing and evidence-based hunting

Which threat intelligence tool is commonly used for graphical link analysis and pivoting between entities?

  1. Maltego Correct answer.
  2. Notepad
  3. Excel pivot tables only
  4. FTP

Explanation

Maltego provides visual graph-based link analysis with transforms that pivot from one entity (domain, person, IP, hash) to related entities via integrated data sources. It is widely used in CTI investigations, OSINT, and reconnaissance.

Question 32Threat models, structured sharing and evidence-based hunting

An analyst evaluates whether produced intelligence is 'fit for purpose.' Which question best assesses this?

  1. Was the report finished on time?
  2. Did the intelligence answer the consumer's PIR clearly enough to drive a decision or action? Correct answer.
  3. Was the report visually appealing?
  4. Did the analyst use the latest version of Word?

Explanation

'Fit for purpose' means the intelligence answers the stakeholder's actual question, at the right level of detail, confidence, and timeliness, and supports a decision. Aesthetics and tools matter less than the cognitive value delivered to the consumer.

Question 33Threat models, structured sharing and evidence-based hunting

Which clustering criterion is MOST useful for grouping multiple intrusions into the same APT activity group?

  1. Time of day of attack only
  2. Shared TTPs, infrastructure overlap, malware code reuse, and victimology patterns Correct answer.
  3. The color of dashboards used
  4. The number of analysts assigned

Explanation

Strong activity-group clustering is built on multiple correlated dimensions: shared TTPs (ATT&CK techniques), infrastructure pivots (registrants, ASN, certificates), code reuse (compile-time fingerprints, custom packers), and victimology (industries, geography). No single dimension is sufficient.

Question 34Threat models, structured sharing and evidence-based hunting

An analyst wants to track how often an adversary is observed reusing infrastructure. Which CTI metric supports this?

  1. Indicator overlap / sightings count across campaigns Correct answer.
  2. Number of HR job postings
  3. Office building lease length
  4. Number of vendor lunches

Explanation

Sightings (how often an indicator appears) and overlap analysis (shared infrastructure across campaigns) reveal adversary tradecraft hygiene. High reuse helps analysts cluster activity into intrusion sets; sudden infrastructure churn may indicate burn after exposure.

Question 35Threat models, structured sharing and evidence-based hunting

An indicator has a published 'first seen' of 2019 and 'last seen' of 2020. By 2026 standards, what is the most likely status?

  1. Almost certainly stale - likely retired and possibly reused by unrelated activity Correct answer.
  2. Highest priority block - always
  3. Confidential national secret
  4. A zero-day

Explanation

Indicators decay rapidly. A hash unseen since 2020 is almost certainly retired; an IP from 2020 may now host benign services. Acting on stale indicators creates false positives and can disrupt legitimate users. Confidence and recency must drive blocking decisions.

Question 36Threat models, structured sharing and evidence-based hunting

An analyst documents that a piece of evidence is 'consistent with' Hypothesis A and 'inconsistent with' Hypothesis B. This documentation is part of which technique?

  1. Static analysis
  2. Analysis of Competing Hypotheses (ACH) Correct answer.
  3. Vulnerability scanning
  4. Sandboxing

Explanation

ACH explicitly tracks how each evidence item supports or contradicts each hypothesis. The matrix form (rows = evidence, columns = hypotheses, cells = C/I/N/A) makes the analyst's reasoning transparent and reproducible.

Question 37Threat models, structured sharing and evidence-based hunting

An analyst evaluates four hypotheses against ten evidence items using ACH. The hypothesis with the FEWEST inconsistencies is selected as the most defensible. Why not the most consistencies?

  1. Heuer's principle: confirming evidence can fit multiple hypotheses; disconfirming evidence rules them out, so the hypothesis least contradicted is most defensible Correct answer.
  2. Random preference
  3. Because consistency counts are always tied
  4. Because executives prefer round numbers

Explanation

Heuer argued that humans naturally seek confirmation, but multiple hypotheses can each be consistent with the same evidence (low diagnostic value). Inconsistencies, however, definitively reduce a hypothesis's plausibility. ACH thus emphasizes minimizing disconfirming evidence to find the most defensible explanation.

Question 38Threat models, structured sharing and evidence-based hunting

Which signal MOST strongly suggests possible attribution to a specific APT group?

  1. A single shared IP address
  2. Combined evidence: shared custom malware family, identical C2 infrastructure overlap, victim industry/geography fit, and TTP fingerprint matching the group's documented profile Correct answer.
  3. Time of day of the alert
  4. Operating system version of the victim

Explanation

Strong attribution requires multi-factor convergence - custom malware code reuse, infrastructure overlap, victimology, and TTPs aligning to the group's documented behavior. Single observables are insufficient and prone to misattribution (false flags, shared commodity tooling).

Question 39Threat-intelligence requirements, collection and dissemination

What is the BLUF (Bottom Line Up Front) writing style used in intelligence reports?

  1. Burying conclusions on the last page
  2. Stating the most important finding and recommendation in the first paragraph, followed by supporting analysis Correct answer.
  3. Using only bullet points with no sentences
  4. Writing in a poetic, narrative style

Explanation

BLUF leads with the conclusion so executives can grasp the key point in 30 seconds. Supporting evidence, analysis, and caveats follow. BLUF is the convention in U.S. intelligence community reporting and is taught in CTIA Domain 6 for executive briefings.

Question 40Threat-intelligence requirements, collection and dissemination

Which standard provides a structured, machine-readable language for describing cyber threat intelligence such as indicators, campaigns, and threat actors?

  1. STIX (Structured Threat Information eXpression) Correct answer.
  2. HTML
  3. PDF/A
  4. SMTP

Explanation

STIX, currently version 2.1 maintained by OASIS, defines SDOs (Indicator, Malware, Threat-Actor, Intrusion-Set, Campaign), SROs (relationships), and SCOs (observables). It enables machine-to-machine sharing and is foundational to modern CTI exchange.

Question 41Threat-intelligence requirements, collection and dissemination

Which protocol delivers STIX content between threat-intelligence producers and consumers?

  1. TAXII (Trusted Automated eXchange of Intelligence Information) Correct answer.
  2. FTP
  3. SNMP
  4. BGP

Explanation

TAXII 2.1 is the application-layer protocol - REST API over HTTPS - for exchanging STIX content. It defines collections (queryable sets) and channels (publish/subscribe). STIX is the data; TAXII is the transport.

Question 42Threat-intelligence requirements, collection and dissemination

What is an ISAC, and what role does it play in intelligence sharing?

  1. Information Sharing and Analysis Center - sector-specific community for sharing threat intelligence among member organizations (e.g., FS-ISAC for financial services) Correct answer.
  2. International Standards Authority Certification
  3. Internet Service Address Computation
  4. Internal Security Audit Coordinator

Explanation

ISACs are non-profit, sector-specific organizations (FS-ISAC, H-ISAC, E-ISAC, MS-ISAC, Auto-ISAC) that share threat intelligence under TLP rules among members. They produce alerts, host secure portals, run STIX/TAXII servers, and coordinate cross-organization response.

Question 43Threat-intelligence requirements, collection and dissemination

An analyst wants to share intelligence in a STIX 2.1 bundle. Which Python library is most commonly used for this?

  1. stix2 Correct answer.
  2. numpy
  3. matplotlib
  4. tensorflow

Explanation

The OASIS-maintained 'stix2' Python library provides classes for SDOs, SROs, SCOs, and bundles, along with serialization/parsing. Combined with 'taxii2-client' it forms the standard Python toolkit for STIX/TAXII automation.

Question 44Threat-intelligence requirements, collection and dissemination

Which U.S. law encourages cyber threat-information sharing between the private sector and the federal government with liability protections?

  1. Cybersecurity Information Sharing Act of 2015 (CISA 2015) Correct answer.
  2. Sarbanes-Oxley Act (SOX)
  3. Health Insurance Portability and Accountability Act (HIPAA)
  4. Children's Online Privacy Protection Act (COPPA)

Explanation

CISA 2015 (signed December 2015) provides liability protection for organizations sharing cyber threat indicators and defensive measures with the federal government via the AIS (Automated Indicator Sharing) program operated by CISA (the agency).

Question 45Threat-intelligence requirements, collection and dissemination

Which intelligence-product type is BEST suited to communicate adversary infrastructure changes to a SOC for immediate detection updates?

  1. Annual board strategy memo
  2. Tactical intelligence bulletin with updated IOCs and detection logic Correct answer.
  3. Quarterly compliance report
  4. Marketing one-pager

Explanation

SOC consumption favors short, machine-readable tactical bulletins: indicator lists, Sigma rule deltas, hunting queries, and ATT&CK technique updates. Strategic, compliance, and marketing artifacts are not appropriate for time-sensitive SOC tuning.

Question 46Threat-intelligence requirements, collection and dissemination

When tailoring a TI report for a non-technical executive audience, which writing choice is BEST?

  1. Maximize technical jargon and packet captures
  2. Lead with business impact, use plain language, summarize evidence at high level, and provide clear recommendations Correct answer.
  3. Include only raw STIX JSON
  4. Use only sub-technique IDs without context

Explanation

Executive readers need to understand business impact (revenue, regulatory, reputational) and what action is requested. Technical depth belongs in appendices. Plain language with quantified risk drives faster decisions and clearer accountability.

Question 47Threat-intelligence requirements, collection and dissemination

Which dissemination delivery mechanism BEST balances confidentiality and machine-readability for sharing TLP:AMBER intelligence with a small partner consortium?

  1. Public website
  2. Authenticated TAXII 2.1 server with TLS and per-collection access control Correct answer.
  3. Anonymous public Pastebin
  4. Twitter post

Explanation

An authenticated TAXII server enforces access control per collection, encrypts in transit, supports STIX exchange, and produces audit logs - appropriate for TLP:AMBER. Public channels would violate AMBER restrictions.

Question 48Threat-intelligence requirements, collection and dissemination

Which best describes a 'sharing relationship' in CTI?

  1. A trusted, agreement-based exchange of intelligence between organizations governed by handling rules and reciprocity expectations Correct answer.
  2. A vendor invoice
  3. An employment contract
  4. A patent license

Explanation

Sharing relationships (member ISAC, bilateral MOU, government partnership) define what intelligence is shared, with whom, under what TLP rules, with what reciprocity. Formal agreements and trust-building activities like joint exercises sustain these relationships.

Question 49Threat-intelligence requirements, collection and dissemination

When integrating threat intelligence into other security tools, which integration pattern pushes machine-readable IOCs to a SIEM or EDR for automated detection?

  1. Manual emailing of PDFs
  2. API/STIX-TAXII integration that updates indicator watchlists automatically Correct answer.
  3. Faxing reports nightly
  4. Posting on internal wiki only

Explanation

Modern integration uses APIs (STIX/TAXII, vendor-specific) to push indicators directly into SIEM watchlists, EDR custom IOCs, and firewall block lists. SOAR playbooks orchestrate this end-to-end. Manual delivery does not scale and introduces lag.

Question 50Threat-intelligence requirements, collection and dissemination

An analyst writes a Python script that fetches a STIX 2.1 bundle from a TAXII server and writes new indicators to MISP. Which CTI capability does this support?

  1. Automated bidirectional sharing and integration of intelligence between platforms Correct answer.
  2. Cracking encrypted malware
  3. Performing destructive incident response
  4. Replacing the entire TI team

Explanation

Automating ingestion from TAXII into MISP closes the gap between external feeds and internal sharing platforms, ensuring fresh indicators reach detection systems quickly. CTIA Domain 6 emphasizes Python automation for sharing/collaboration workflows.