Requirements Planning Direction And Review

During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?

A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

An organization is updating its threat landscape analysis methodology to better account for sector-specific threats. Which stakeholder group should the CTI team primarily consult to gather accurate sector-specific threat requirements?

A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?

An intelligence analyst is tasked with tailoring intelligence requirements for a merger and acquisition (M&A) scenario. Which methodology should be applied during the direction phase to identify threat actors specifically interested in compromising corporate transactions?

During the planning phase of building a CTI team, the program manager needs to define the scope of intelligence operations. Which category of intelligence focuses specifically on technical indicators such as file hashes, IP addresses, and domain names?

A newly formed CTI team is conducting stakeholder interviews to establish intelligence requirements. The Chief Risk Officer (CRO) expresses concern over ransomware supply chain disruptions. How should the intelligence analyst translate this concern into a formal intelligence requirement?

An intelligence manager is reviewing the threat intelligence program's intelligence gap analysis. The analysis reveals that the team frequently fails to detect supply chain intrusions until late in the attack lifecycle. Which adjustments to the direction and planning phase should the manager implement?

During the CTI team building process, the manager needs to hire personnel with analytical mindsets who can avoid cognitive biases. Which cognitive bias involves favoring information that confirms pre-existing beliefs while discarding contradictory evidence?

An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?

An organization is establishing metrics for its Threat Intelligence program review. The CTI director wants to measure 'Collection Efficiency.' Which formula or evaluation method best represents this metric?

A CTI program is conducting a formal review of its intelligence requirements to ensure alignment with changing business goals. Which phase of the intelligence cycle directly feeds into the direction and planning phase during this review?

During the requirements planning phase, a CTI analyst categorizes intelligence needs based on consumer levels. Which THREE types of intelligence consumers must be addressed in a comprehensive intelligence plan? (Choose THREE)

An intelligence manager is evaluating sources for a threat intelligence program during the planning phase. Which TWO criteria are critical when vetting a new external threat intelligence vendor or feed? (Choose TWO)

When establishing a Threat Intelligence program, a manager must outline the core functions of the TI team. Which TWO of the following responsibilities typically fall under a dedicated CTI team's scope? (Choose TWO)

During the threat landscape analysis and requirements gathering process, an organization must identify its critical assets and crown jewels. Which THREE categories represent typical critical assets that should drive intelligence requirements? (Choose THREE)

An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)

During program planning for a CTI team, the program manager must define stakeholder engagement protocols. Which THREE stakeholder groups should be actively engaged during the requirements planning and review phases? (Choose THREE)

An organization is conducting a review of its threat intelligence program to assess alignment with intelligence-driven defense models. Which TWO frameworks are widely used to structure threat intelligence planning, collection, and defense operations? (Choose TWO)

When planning a Threat Intelligence program budget, an organization must account for various resource categories. Which THREE resource categories should be included in the CTI program budget plan? (Choose THREE)

A retail company's newly appointed CTI lead is defining the direction phase for the coming year. The Chief Information Security Officer asks her to document how intelligence requirements will be gathered from the business and turned into a prioritized set of questions the team must answer. Which deliverable best represents the output of the direction phase?

A global manufacturing company is establishing a new CTI program. The CISO wants to ensure that intelligence production remains focused on the organization's most critical business assets and that resources are allocated efficiently. Which of the following should the CTI manager produce FIRST to define the specific intelligence needs that support strategic decision-making?

A CTI analyst is defining Intelligence Requirements (IRs) for a new threat intelligence program. The CISO asks the analyst to ensure that the IRs are both actionable and aligned with the organization's risk appetite. Which of the following is the MOST appropriate first step in this process?

A CTI analyst is conducting a review of the intelligence program after six months of operation. The review reveals that several PIRs are no longer relevant due to a recent merger and acquisition. The analyst must realign the intelligence requirements with the new business strategy. Which of the following activities should the analyst perform FIRST to ensure the requirements remain effective?

A CTI analyst is conducting the direction phase for a new intelligence requirement focused on a persistent threat group targeting the organization's financial systems. The analyst must define the Essential Elements of Information (EEI) to guide collection. Which of the following best describes the purpose of EEIs in this context?

A threat intelligence analyst is assigned to establish a collection plan for a new business unit that has just expanded its operations to the cloud. The analyst needs to determine the most effective source to gather information about threat actors specifically targeting cloud service providers and their attack techniques. Which of the following sources should the analyst prioritize?

A CTI manager is reviewing the team's Priority Intelligence Requirements (PIRs) and notices that they are too broad, making it difficult to focus collection efforts. Which action should the manager take to improve the PIRs?

A CTI manager is reviewing the intelligence requirements after a major business acquisition expanded the organization's presence into new regions. The manager must adjust the requirements to address new risks. Which TWO of the following actions are most appropriate during this review? (Choose two.)

A CTI team is developing its intelligence requirements for the upcoming year. The team lead wants to ensure that the requirements are structured to support both tactical and strategic decision-making. Which of the following best describes the primary purpose of defining Priority Intelligence Requirements (PIRs)?

A CTI manager is conducting a review of the intelligence requirements after a major merger. The organization's priorities have shifted, and the manager must ensure that the collection efforts remain aligned with the new business objectives. Which of the following actions best ensures that the intelligence requirements continue to meet the evolving needs?

A CTI analyst is tasked with developing a collection plan to support the organization's intelligence requirements. The analyst must prioritize sources based on reliability, relevance, and cost. Which of the following criteria should be the PRIMARY consideration when selecting sources?

A CTI analyst is developing a collection plan to support a new intelligence requirement on ransomware targeting the healthcare sector. The analyst needs to identify the most appropriate type of collection to gather information on ransomware variants and their tactics. Which of the following collection sources is best suited for this requirement?

A CTI analyst is tasked with reviewing the effectiveness of the intelligence program. The analyst notices that despite having clear PIRs, the intelligence reports often fail to answer the specific questions posed by decision-makers. Which of the following should the analyst evaluate FIRST to identify the root cause?

During the direction phase of the intelligence cycle, a CTI analyst receives a request from the Chief Information Security Officer (CISO) for intelligence on a specific threat actor group that has been targeting the organization's industry. The analyst must translate this request into a formal intelligence requirement. Which of the following is the most appropriate first step?

A CTI analyst is tasked with producing a threat assessment for the upcoming quarter. The analyst must decide which intelligence requirements to prioritize based on the organization's risk appetite and current threat landscape. Which of the following criteria is most important when prioritizing requirements?

A CTI team is conducting a requirements review with stakeholders to ensure the intelligence program remains aligned with business objectives. Which TWO activities are essential during this review? (Choose two.)

A CTI manager is conducting a formal review of the intelligence program to ensure it remains aligned with business goals. The review will assess the effectiveness of the requirements planning, direction, and review phases. Which TWO activities are essential components of the review phase in the intelligence cycle? (Choose two.)

A CTI team is developing a collection plan for a new intelligence requirement focused on ransomware groups targeting the healthcare sector. The team must select the most relevant sources to gather information on these groups' tactics, techniques, and procedures (TTPs). Which of the following sources would provide the most direct and actionable intelligence for this requirement?

A CTI analyst is conducting a review of the intelligence requirements after a series of false positives from automated collection tools. The review aims to refine the requirements to reduce noise. Which of the following actions best addresses this issue?

A CTI analyst is developing a set of Specific Intelligence Requirements (SIRs) to support the organization's PIRs. The analyst must ensure that each SIR is measurable and time-bound. Which of the following is the BEST example of a well-formulated SIR?

A CTI analyst is tasked with creating a collection plan for a new intelligence requirement focused on advanced persistent threat (APT) actors targeting the organization's cloud infrastructure. The analyst must consider various factors to ensure the plan is effective. Which TWO of the following are essential components of an effective collection plan for this requirement? (Choose two.)

A newly appointed CTI lead at a financial services firm is asked to align the intelligence program with the business’s strategic risk appetite. The executive team wants to know how CTI will support decisions about mergers and acquisitions. Which of the following best describes the primary purpose of defining Priority Intelligence Requirements (PIRs) in this context?

A CTI manager is conducting a requirements review with stakeholders from legal, IT, and business units. During the meeting, the legal team requests intelligence on data breach notification laws in all 50 U.S. states. The CTI team currently has no collection sources for legal research. Which action should the CTI manager take FIRST to address this request?

A CTI analyst is drafting intelligence requirements for a new program. The analyst wants to ensure that each requirement is actionable and can be used to guide collection. Which of the following is the most important characteristic of a well-written intelligence requirement?

A CTI team is conducting a periodic review of its intelligence requirements. The team notices that several requirements have not generated any collection or analysis in the past six months. Which of the following is the MOST appropriate action for the team to take?

A CTI manager is developing a collection plan to support a new intelligence requirement on supply chain attacks targeting the organization’s software vendors. The manager needs to identify the types of intelligence sources that should be included. Which THREE of the following are appropriate sources for this collection plan? (Choose three.)