I85PREP
⌘ K
Mile2 C)TIA study materials
Mile2 C)TIA study resources

Mile2 C)TIA practice questions

One question at a time. Build your Mile2 C)TIA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Threat Intelligence Analysis

In threat intelligence, which term describes raw indicators such as IP addresses, domains, and file hashes before any context or attribution is applied?

  1. Indicators of compromise Correct answer.
  2. Confidence levels
  3. Strategic intelligence
  4. Tactics, techniques, and procedures

Explanation

Indicators of compromise are the atomic, observable artifacts of a compromise, such as hashes, domains, and IP addresses. They gain meaning only when analysts add context about adversary behavior and targeting.

Question 2Threat Intelligence Analysis

Which intelligence level primarily informs a CISO deciding how much budget to allocate to defending against a multi-year adversary campaign?

  1. Strategic intelligence Correct answer.
  2. Tactical intelligence
  3. Technical intelligence
  4. Operational intelligence

Explanation

Strategic intelligence supports long-range planning and resource decisions by describing threat trends, actor intent, and risk to the organization. Budget and campaign-level decisions sit at that strategic layer.

Question 3Threat Intelligence Analysis

An analyst receives a feed of malicious IP addresses but no information on which campaigns or actors use them. Which intelligence discipline does this feed represent?

  1. Strategic intelligence
  2. Attribution intelligence
  3. Technical intelligence Correct answer.
  4. Operational intelligence

Explanation

Bare indicators such as IP addresses are technical intelligence, the machine-readable layer used for detection. Without campaign or actor context they do not rise to operational or strategic intelligence.

Question 4Threat Intelligence Analysis

What is the primary purpose of the intelligence cycle's direction phase?

  1. Aligning collection with decision-maker requirements Correct answer.
  2. Converting raw data into finished reports
  3. Disseminating products to stakeholders
  4. Evaluating source reliability

Explanation

The direction phase sets requirements and priorities so that collection answers the questions decision-makers actually need. It prevents wasted collection by defining intelligence priorities up front.

Question 5Threat Intelligence Analysis

Which model is most commonly used to describe adversary behavior as a sequence of phases from reconnaissance through actions on objectives?

  1. The MITRE ATT&CK matrix
  2. The Lockheed risk matrix
  3. The Diamond Model
  4. The Cyber Kill Chain Correct answer.

Explanation

The Cyber Kill Chain models an intrusion as ordered phases, from reconnaissance and weaponization through exploitation, command and control, and actions on objectives. ATT&CK catalogs techniques rather than a single linear sequence.

Question 6Threat Intelligence Analysis

In the Diamond Model, which vertex represents the tools and malware an adversary uses during an intrusion event?

  1. Infrastructure
  2. Victim
  3. Adversary
  4. Capability Correct answer.

Explanation

The Diamond Model's four vertices are adversary, capability, infrastructure, and victim. Capability refers to the tools, malware, and exploits the adversary employs.

Question 7Threat Intelligence Analysis

An analyst maps observed adversary behavior to ATT&CK technique T1566 for phishing. Which analytical benefit does this mapping primarily provide?

  1. It guarantees detection coverage in the SIEM
  2. It replaces the need for indicator collection
  3. It confirms the identity of the threat actor
  4. It provides a common vocabulary for describing and comparing behavior Correct answer.

Explanation

ATT&CK provides a standardized taxonomy of adversary techniques so teams can describe, compare, and prioritize behavior consistently. Mapping behavior to a technique does not by itself establish attribution or guarantee detection.

Question 8Threat Intelligence Analysis

Which statement best distinguishes a tactic from a technique in MITRE ATT&CK?

  1. A tactic is the adversary's goal, while a technique is how the goal is achieved Correct answer.
  2. A tactic is an indicator, while a technique is an alert
  3. A tactic is a specific tool, while a technique is a broad objective
  4. A tactic is a detection rule, while a technique is a log source

Explanation

In ATT&CK, tactics are the adversary's tactical goals, such as persistence or exfiltration, while techniques are the specific methods used to accomplish those goals. This goal-versus-method distinction organizes the matrix.

Question 9Threat Intelligence Analysis

Which characteristic most clearly indicates that a threat intelligence source is of high quality?

  1. It publishes a high volume of indicators daily
  2. It is distributed only through social media
  3. It documents its collection methodology and confidence Correct answer.
  4. It lists indicators without any timestamps

Explanation

Quality intelligence is transparent about how data was collected and how confident the source is in its judgments. Volume alone and missing timestamps undermine reliability and actionability.

Question 10Threat Intelligence Analysis

An analyst must rate a human source using the Admiralty code. A source judged usually reliable with information that is possibly true is expressed as which pairing?

  1. C3
  2. B2 Correct answer.
  3. A1
  4. D4

Explanation

The Admiralty code pairs a letter for source reliability with a number for information credibility. B means usually reliable and 2 means possibly true, so B2 fits that description.

Question 11Threat Intelligence Analysis

Which practice best mitigates the risk of circular reporting when consuming threat intelligence feeds?

  1. Republishing every feed item immediately
  2. Removing source attribution to simplify reports
  3. Relying on a single aggregator for all intelligence
  4. Corroborating claims with independent primary sources Correct answer.

Explanation

Circular reporting occurs when multiple outlets repeat the same unverified claim, creating a false impression of corroboration. Tracing claims to independent primary sources prevents this amplification of a single origin.

Question 12Threat Intelligence Analysis

What does the Traffic Light Protocol marking TLP:RED indicate about sharing a report?

  1. It is limited to the specific recipients defined by the originator Correct answer.
  2. It may be posted to open forums after 30 days
  3. It may be shared publicly without restriction
  4. It may be shared with any trusted partner community

Explanation

TLP:RED restricts information to the named recipients only, typically for in-person or direct exchange. Broader sharing requires the originator's permission.

Question 13Threat Intelligence Analysis

Which TLP marking permits sharing within a defined community, such as a sector ISAC, but not with the general public?

  1. TLP:CLEAR
  2. TLP:AMBER Correct answer.
  3. TLP:GREEN
  4. TLP:RED

Explanation

TLP:AMBER allows sharing within a defined community or with partner organizations, while public release is not permitted. TLP:GREEN is broader and TLP:RED is recipient-limited.

Question 14Threat Intelligence Analysis

Which analytic technique helps an analyst avoid premature closure when assessing a suspected intrusion?

  1. Anchoring on the first hypothesis
  2. Analysis of competing hypotheses Correct answer.
  3. Groupthink
  4. Confirmation bias

Explanation

Analysis of competing hypotheses systematically evaluates alternative explanations against the evidence, reducing premature closure. It forces the analyst to consider and weigh rival hypotheses.

Question 15Threat Intelligence Analysis

An analyst writes that an intrusion is "highly likely" attributable to a known group but cites only a single shared malware family. Which analytic flaw is most evident?

  1. Failure to use the Cyber Kill Chain
  2. Overcollection of strategic intelligence
  3. Excessive use of structured analytic techniques
  4. Overreliance on a single weak indicator for attribution Correct answer.

Explanation

Shared malware is frequently reused or leaked, so it is weak grounds for attribution on its own. Strong attribution relies on multiple independent lines of evidence rather than one indicator.

Question 16Threat Intelligence Analysis

Which factor most complicates confident attribution of a cyber intrusion to a specific nation-state?

  1. The existence of threat intelligence platforms
  2. Adversaries using false flags and shared tooling Correct answer.
  3. The availability of open-source intelligence
  4. The use of the intelligence cycle

Explanation

Adversaries deliberately use false flags, shared infrastructure, and commodity tooling to obscure identity. These practices create ambiguity that undermines confident attribution.

Question 17Threat Intelligence Analysis

Which action best demonstrates applying threat intelligence to prioritize patching?

  1. Waiting for annual patch cycles regardless of threat activity
  2. Patching only systems with the most installed software
  3. Prioritizing vulnerabilities actively exploited by actors targeting your sector Correct answer.
  4. Patching systems in the order they were inventoried

Explanation

Threat-informed prioritization focuses remediation on vulnerabilities that adversaries are actively exploiting against organizations like yours. This connects intelligence to risk reduction rather than inventory order.

Question 18Threat Intelligence Analysis

Which collection source typically provides the earliest warning of a new phishing campaign targeting an organization's employees?

  1. Vendor marketing brochures
  2. Quarterly board meeting minutes
  3. Annual strategic threat reports
  4. Employee reports of suspicious emails Correct answer.

Explanation

Employee reports of suspicious emails are a timely internal sensor that can surface new phishing campaigns quickly. Strategic reports and marketing materials lag behind live activity.

Question 19Threat Intelligence Analysis

An indicator feed lists a domain resolved to a sinkhole IP address controlled by law enforcement. What is the most appropriate analytic conclusion?

  1. The domain is a confirmed command-and-control server in use
  2. The domain is actively serving malware to victims
  3. The domain should be blocked as an active exfiltration channel
  4. The domain's infrastructure has likely been disrupted Correct answer.

Explanation

Sinkholing redirects malicious domains to infrastructure controlled by defenders or law enforcement, indicating disruption of the adversary's original infrastructure. The domain is therefore unlikely to be actively serving malware through its original path.

Question 20Threat Intelligence Analysis

What does the confidence level in a finished intelligence product communicate to decision-makers?

  1. The probability that the report will be leaked
  2. The analytic certainty behind a judgment, separate from the likelihood of the event Correct answer.
  3. The classification level of the report
  4. The number of sources collected

Explanation

Confidence expresses how much the analyst trusts the judgment given available evidence, which is distinct from the likelihood that an event will occur. Separating the two prevents decision-makers from conflating certainty with probability.

Question 21Threat Intelligence Analysis

Which statement correctly distinguishes probability from confidence in an intelligence estimate?

  1. Probability and confidence are interchangeable terms
  2. Probability applies only to strategic intelligence
  3. Probability describes event likelihood, while confidence describes strength of the analytic basis Correct answer.
  4. Confidence describes event likelihood, while probability describes source count

Explanation

Probability estimates how likely an event is, whereas confidence reflects how strong and reliable the underlying evidence and reasoning are. A high-probability judgment can rest on low confidence and vice versa.

Question 22Threat Intelligence Analysis

Which output is the most actionable deliverable for a SOC team consuming threat intelligence?

  1. A historical essay on malware families
  2. A vendor price comparison
  3. A watchlist of indicators with context and expiry guidance Correct answer.
  4. A board-level summary of geopolitical risk

Explanation

SOC teams need operational products such as contextualized indicators with guidance on how long to use them. Context and expiry prevent stale indicators from generating noise.

Question 23Threat Intelligence Analysis

Why should indicators of compromise be aged and revalidated over time?

  1. Indicators become illegal to store after 30 days
  2. Older indicators are always more valuable than recent ones
  3. Aging indicators improves their precision automatically
  4. Adversaries rotate infrastructure and indicators quickly, so stale indicators cause false positives Correct answer.

Explanation

Adversaries frequently change infrastructure, and old indicators may be reassigned to benign owners, producing false positives. Aging and revalidation keep detection relevant and reduce noise.

Question 24Threat Intelligence Analysis

Which platform is commonly used to exchange structured cyber threat intelligence using a standardized language?

  1. SMTP with POP3 transport
  2. NTP with DNS transport
  3. SNMP with Syslog transport
  4. STIX with TAXII transport Correct answer.

Explanation

STIX is a structured language for representing threat intelligence, and TAXII is the transport protocol used to exchange it. Together they support automated sharing between platforms.

Question 25Threat Intelligence Analysis

An analyst sees a report claiming a threat actor will target the organization next quarter, based only on a single blog post with no corroboration. What is the most defensible analytic response?

  1. Assign low confidence, seek corroboration, and state the limitation Correct answer.
  2. Attribute the activity to a specific nation-state
  3. Treat the claim as confirmed and escalate immediately as fact
  4. Discard the report without documenting it

Explanation

A single uncorroborated blog post warrants low confidence and further collection before acting. Documenting the limitation keeps decision-makers aware of the evidence gap.

Question 26Threat Intelligence Analysis

Which term describes the raw, unevaluated data collected from sensors and feeds before any analyst has assessed its meaning?

  1. Tactical intelligence
  2. Finished intelligence
  3. Operational intelligence
  4. Data Correct answer.

Explanation

In the intelligence cycle, data is the unprocessed raw material gathered from collection sources such as logs, feeds, and reports. Only after processing, analysis, and evaluation does it become intelligence fit for decision-making.

Question 27Threat Intelligence Analysis

A SOC analyst is told to produce intelligence that helps the incident response team identify which adversary behaviors to detect during an active intrusion. Which intelligence level does this primarily require?

  1. Strategic intelligence
  2. Tactical intelligence Correct answer.
  3. Geopolitical intelligence
  4. Estimative intelligence

Explanation

Tactical intelligence describes adversary TTPs and indicators that defenders use directly in detection and response. It is consumed at the operational/technical level, unlike strategic intelligence, which informs long-term executive decisions.

Question 28Threat Intelligence Analysis

Which source type is considered primary when an analyst wants original, firsthand data about an intrusion?

  1. A peer-reviewed journal article citing the incident
  2. The organization's own endpoint telemetry and packet captures Correct answer.
  3. A vendor blog summarizing the incident
  4. A news article quoting the affected company's spokesperson

Explanation

Primary sources contain firsthand, original data collected directly from the environment, such as telemetry and packet captures. Secondary and tertiary sources interpret, summarize, or reference that original data and may introduce distortion.

Question 29Threat Intelligence Analysis

An analyst obtains an indicator from a public report whose author does not state how the indicator was collected or validated. Which assessment is most appropriate?

  1. Deploy the indicator to blocking controls without further review
  2. Assign low confidence and seek independent corroboration before operational use Correct answer.
  3. Treat the indicator as confirmed because it appeared in a published report
  4. Reject the indicator immediately because public reports are never useful

Explanation

Indicators lacking provenance or validation should be treated with low confidence until corroborated by independent sources. Deploying unverified indicators risks false positives and operational disruption.

Question 30Threat Intelligence Analysis

Which activity in the intelligence cycle immediately follows the collection of data?

  1. Analysis and production
  2. Planning and direction
  3. Dissemination
  4. Processing and exploitation Correct answer.

Explanation

After collection, data must be processed and exploited, meaning it is converted into a usable form such as normalized logs or decoded payloads. Analysis and production come after processing, and dissemination occurs at the end of the cycle.

Question 31Threat Intelligence Analysis

What is the primary purpose of establishing intelligence requirements before beginning collection?

  1. To define the questions the intelligence must answer so collection is focused Correct answer.
  2. To ensure every available feed is ingested regardless of relevance
  3. To assign blame if an intrusion is later detected
  4. To satisfy regulatory requirements for data retention

Explanation

Intelligence requirements translate decision-maker needs into prioritized questions, which focus collection and analysis on what matters. Without requirements, collection becomes unfocused and produces volume without relevance.

Question 32Threat Intelligence Analysis

Which of the following best describes structured analytic techniques in threat intelligence?

  1. Formal methods that make reasoning explicit and challenge assumptions Correct answer.
  2. Procedures for encrypting intelligence data at rest
  3. Automated tools that replace analyst judgment
  4. Techniques used only for writing final reports

Explanation

Structured analytic techniques are formal, repeatable methods that externalize an analyst's reasoning so biases and assumptions can be examined. They support, rather than replace, analyst judgment.

Question 33Threat Intelligence Analysis

An analyst receives a report marked TLP:AMBER+STRICT. Which sharing action is consistent with that marking?

  1. Posting the report to a public threat-sharing forum
  2. Forwarding the report to a journalist for publication
  3. Sharing the report only within the recipient organization Correct answer.
  4. Sharing the report with any trusted partner organization

Explanation

TLP:AMBER+STRICT restricts sharing to the recipient organization only, with no onward sharing to external partners. This is narrower than standard TLP:AMBER, which permits sharing within a community.

Question 34Threat Intelligence Analysis

An analyst is assessing an adversary's likely next target and relies on one memorable recent incident rather than reviewing the full historical data set. Which cognitive bias is this?

  1. Confirmation bias
  2. Anchoring bias
  3. Availability heuristic Correct answer.
  4. Hindsight bias

Explanation

The availability heuristic causes analysts to overweight examples that come easily to mind, such as a vivid recent incident, instead of the full evidence base. Anchoring, confirmation, and hindsight biases involve different mechanisms.

Question 35Threat Intelligence Analysis

An analyst must express an assessment that an adversary will likely exploit a specific vulnerability within 30 days. Which statement best reflects proper analytic standards?

  1. The adversary will exploit the vulnerability within 30 days.
  2. It is almost certain that the adversary will exploit the vulnerability within 30 days.
  3. Exploitation is possible, certain, and unlikely all at once.
  4. We assess with moderate confidence that the adversary will likely exploit the vulnerability within 30 days. Correct answer.

Explanation

Proper analytic standards separate the probability judgment (likely) from the confidence in that judgment (moderate confidence) and use clear estimative language. This lets decision-makers weigh both likelihood and analytic certainty.

Question 36Threat Intelligence Analysis

A report describes an adversary group's infrastructure, including domains and TLS certificate patterns, that is reused across campaigns. Which analytic concept best explains why these indicators support tracking the group over time?

  1. Certificate patterns are irrelevant to attribution
  2. Malware hashes are the most durable indicator type
  3. Indicators are valuable only for immediate blocking
  4. Reusable infrastructure provides durable linkage across separate intrusion events Correct answer.

Explanation

Durable, reusable infrastructure such as domain patterns and certificate characteristics persists across campaigns, providing a linkage that supports tracking and attribution over time. Volatile indicators like hashes change too quickly to serve this role.

Question 37Threat Intelligence Analysis

During an intrusion, an analyst observes the adversary using a legitimate remote monitoring tool already approved in the environment. Which analytic conclusion is most defensible?

  1. The activity must be a false positive because the tool is sanctioned
  2. Approved tools can never be used maliciously
  3. The tool itself proves the adversary is an insider
  4. Living-off-the-land behavior can mask malicious activity within legitimate tooling Correct answer.

Explanation

Adversaries frequently abuse legitimate, sanctioned tools to blend in, which is why behavior and context matter more than tool presence alone. Concluding insider involvement from tool use alone is unsupported.

Question 38Threat Intelligence Analysis

An analyst wants to compare the behavior of two suspected campaigns to determine whether they share an operator. Which approach best supports this comparison?

  1. Rely solely on the geographic origin of source IP addresses
  2. Cluster shared TTPs, infrastructure, and tooling artifacts across both campaigns Correct answer.
  3. Compare only the malware file names observed
  4. Assume shared targeting of the same industry proves a shared operator

Explanation

Campaign linkage is strongest when multiple independent dimensions, such as TTPs, infrastructure, and tooling, align. Single weak indicators like file names, IP geography, or shared targeting are insufficient.

Question 39Threat Intelligence Analysis

A feed provides indicators with a confidence score and a first-seen timestamp. Which use of that metadata best improves operational decision-making?

  1. Using the timestamp to delete all indicators immediately
  2. Prioritizing high-confidence, recently seen indicators for immediate detection Correct answer.
  3. Blocking only indicators older than one year
  4. Ignoring scores and blocking every indicator equally

Explanation

Confidence scores and recency help analysts rank indicators so limited detection resources go to the most reliable and current ones. Treating all indicators equally ignores meaningful quality differences.

Question 40Threat Intelligence Analysis

An analyst is asked to evaluate whether a threat actor has the capability to target a specific industrial control system. Which evidence most directly supports a capability assessment?

  1. The number of followers on the actor's social media accounts
  2. Observed tooling and prior operations against similar control systems Correct answer.
  3. The actor's public statements about future intentions
  4. The actor's preferred language and time zone

Explanation

Capability assessments are grounded in demonstrated tooling and prior operations against comparable targets. Intentions, linguistic cues, and social media popularity do not demonstrate technical capability.

Question 41Threat Intelligence Analysis

What distinguishes an intelligence gap from an intelligence requirement?

  1. A gap is the final report delivered to leadership
  2. A gap is a requirement that has already been satisfied
  3. A gap is a known unknown that must be filled to answer a requirement Correct answer.
  4. A gap is a collection source that has been decommissioned

Explanation

Intelligence requirements define what decision-makers need to know, while gaps are the specific missing information that prevents answering those requirements. Identifying gaps drives new collection and analysis.

Question 42Threat Intelligence Analysis

An analyst is producing a threat assessment for executives who must decide on budget allocation for defenses. Which product characteristic matters most?

  1. Clear linkage of threat findings to business risk and decisions Correct answer.
  2. Exhaustive listing of every feed consulted
  3. Maximum technical detail on individual IOCs
  4. Use of jargon to demonstrate analytic depth

Explanation

Strategic products for executives must connect threat findings to business risk and actionable decisions. Excessive technical detail or jargon obscures the decision-relevant message.

Question 43Threat Intelligence Analysis

An analyst discovers that two separate intelligence vendors cite the same original blog post as evidence for a claim. How should the analyst treat this?

  1. As a single source requiring additional independent validation Correct answer.
  2. As confirmed fact because two vendors agree
  3. As invalid because vendors are unreliable
  4. As two independent corroborating sources

Explanation

When multiple sources trace back to one origin, they represent a single source, not independent corroboration. Additional independent evidence is needed before raising confidence.

Question 44Threat Intelligence Analysis

Which analytic technique involves deliberately arguing against a favored hypothesis to test its strength?

  1. Key assumptions check
  2. Red team analysis
  3. Devil's advocacy Correct answer.
  4. Analysis of competing hypotheses

Explanation

Devil's advocacy assigns an analyst or team to challenge a favored judgment by arguing the opposing case. Key assumptions checks examine underlying beliefs, while ACH systematically weighs multiple hypotheses against evidence.

Question 45Threat Intelligence Analysis

A newly published report claims a threat actor will shift targeting to a specific sector next quarter. Which combination of factors should most increase an analyst's confidence in this claim?

  1. Multiple independent sources with corroborating evidence and a stated methodology Correct answer.
  2. A single anonymous post repeated by several aggregators
  3. A vendor marketing page promoting a new product
  4. A claim consistent with the analyst's existing beliefs

Explanation

Confidence rises when independent sources corroborate a claim and the methodology is transparent enough to evaluate. Repetition by aggregators, marketing content, and belief-consistency do not add evidentiary weight.

Question 46Threat Intelligence Analysis

An analyst finds that an adversary's command-and-control domain uses a domain generation algorithm. Which analytic implication is most significant?

  1. The adversary has abandoned infrastructure rotation
  2. Static domain blocklists will remain fully effective
  3. DNS logging becomes unnecessary
  4. Individual domain indicators are volatile, so behavioral detection is more durable Correct answer.

Explanation

DGA-generated domains change rapidly, so static blocklists quickly become stale. Detecting the underlying behavior, such as DGA patterns or beaconing, provides more durable defense.

Question 47Threat Intelligence Analysis

Two reports attribute the same intrusion to different actors. Report A cites shared malware code; Report B cites shared infrastructure. Which analytic approach best resolves the conflict?

  1. Accept Report B because infrastructure is always definitive
  2. Evaluate each piece of evidence for reliability and independence, and weigh competing hypotheses Correct answer.
  3. Accept Report A because malware code is always definitive
  4. Average the two attributions and report both as equally likely

Explanation

Conflicting attributions require weighing the reliability, independence, and specificity of each evidence type against competing hypotheses. Neither malware code nor infrastructure is automatically definitive, and averaging is not analysis.

Question 48Threat Intelligence Analysis

An analyst must decide whether a set of indicators is suitable for long-term hunting versus immediate blocking. Which characteristic most determines that an indicator is better suited to hunting?

  1. It is a file hash observed once in a single incident
  2. It describes a behavioral pattern such as unusual parent-child process relationships Correct answer.
  3. It appears in a feed with no metadata
  4. It is an IP address with a short lease time

Explanation

Behavioral patterns are durable and support hypothesis-driven hunting across environments, while volatile artifacts like single-observation hashes, short-lease IPs, and metadata-poor feed entries are weak long-term indicators.

Question 49Threat Intelligence Analysis

An analyst notes that a threat actor's observed targeting has shifted after a public disclosure of its infrastructure. Which interpretation best reflects sound analytic reasoning?

  1. The shift means prior intelligence was fabricated
  2. The shift may reflect operational security adaptation and should be monitored, not assumed final Correct answer.
  3. The actor has permanently ceased operations
  4. The shift proves the actor is a different group

Explanation

Adversaries commonly adapt operations after exposure, so a targeting shift is best treated as possible OPSEC adaptation requiring continued monitoring. Assuming permanent cessation, identity change, or fabrication overreaches the evidence.

Question 50Threat Intelligence Analysis

Which practice best ensures that finished threat intelligence remains useful to its intended consumers over time?

  1. Collecting consumer feedback and updating products as the threat landscape changes Correct answer.
  2. Removing all source citations to protect sources
  3. Restricting distribution to a single analyst
  4. Delivering the same static report indefinitely

Explanation

Intelligence is a continuous cycle; consumer feedback and periodic updates keep products relevant as threats evolve. Static delivery, narrow distribution, and removal of citations undermine usefulness and trust.