312-85 Intelligence Reporting And Dissemination — All Questions With Answers

Question 1easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

Your organization uses a TIP (Threat Intelligence Platform) to ingest STIX feeds. You notice that the ingest process is failing specifically for feeds sourced from an older platform using STIX 1.2. Why is this occurring?

Question 2mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are configuring a TAXII 2.1 server to share threat indicators with a government partner. You need to ensure the connection enforces the transport-level security requirements for sensitive data exchange. Which setting must you verify in the TAXII configuration?

Question 3hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

When setting up a TAXII 2.1 client, which THREE settings are mandatory for establishing a successful connection to a server?

Question 4hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which THREE of the following are valid reasons to use the STIX 'Sighting' object?

Question 5easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

Your organization is mandated to share threat indicators under the Traffic Light Protocol (TLP). Which TLP marking indicates that the information can be shared with peers within the sector but should not be distributed publicly?

Question 6mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are drafting a STIX 2.1 'Observed-Data' object to report an IP address involved in a recent exfiltration event. To maintain standard compliance for automated ingestion, which property is mandatory to define the temporal scope of the observation?

Question 7mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are integrating a new threat intelligence platform (TIP). You need to define a 'Custom Object' in STIX 2.1 to track a specific internal project codename associated with threat actors. Which prefix must be used for the custom object name to ensure compatibility and avoid collisions?

Question 8mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are auditing your TAXII server configuration for data sharing compliance. Which TWO of the following items must be explicitly defined for each collection to ensure correct data governance and access control?

Question 9mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are preparing a threat intelligence report to be shared with a partner organization under the Traffic Light Protocol (TLP). The report includes indicators of compromise and contextual analysis. Which two actions should you take to ensure proper dissemination and handling? (Choose two.)

Question 10hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

An analyst is preparing a threat intelligence report for the CISO that includes a detailed technical analysis of a new malware variant. The report contains specific IOCs and TTPs, and the organization wants to share it with a trusted partner under TLP:AMBER. However, the partner is a commercial entity, not a government agency. Which dissemination method is most appropriate to ensure compliance with TLP:AMBER?

Question 11easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst at a healthcare organization. You have received a threat intelligence report from a trusted partner. The report is marked TLP:AMBER. According to the Traffic Light Protocol, how should you handle this information?

Question 12easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a threat intelligence analyst preparing to share a report with a partner organization. The report contains information that should only be shared within your two organizations and not with any third parties. Which TLP marking should you apply?

Question 13hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are troubleshooting a synchronization issue between two threat intelligence platforms. One platform is configured for TAXII 2.1 and the other is receiving the data but failing to parse the STIX 2.1 bundle. Which diagnostic step is most appropriate?

Question 14hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

An analyst is mapping internal incident data to STIX 2.1 objects. You need to link a specific threat actor to the infrastructure they recently utilized. Which object type should you use to link the 'Threat-Actor' object to the 'Infrastructure' object?

Question 15mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are drafting an executive threat report and need to adhere to the Traffic Light Protocol (TLP). The report contains sensitive information about an ongoing vulnerability in a zero-day exploit that could cause irreparable damage if leaked. Which TLP color should be applied?

Question 16hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

When setting up a TAXII 2.1 Collection in a commercial TIP, you are asked to provide a 'Collection ID'. What is the primary purpose of this identifier?

Question 17mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are integrating a new threat intel feed that provides 'Course of Action' (CoA) objects. What is the intended use of this STIX object type in an automated environment?

Question 18easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

A CISO asks for a report that provides a strategic outlook on the threat landscape for the upcoming quarter. What format is most appropriate for this type of audience?

Question 19hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

An organization wants to contribute intelligence to an ISAC (Information Sharing and Analysis Center). They need to ensure their sharing mechanism supports automated, near-real-time updates. Which standard should they adopt?

Question 20easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

When preparing a report for a SOC team, which metric is most important to include to prove the intelligence is actionable?

Question 21easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

Which regulatory framework should a company consider when sharing threat intelligence that contains PII (Personally Identifiable Information) with international partners?

Question 22hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

A threat intelligence report uses the Diamond Model for Intrusion Analysis. You are adding a new 'Victim' node. What information should you include to align with this model?

Question 23mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are analyzing an intelligence report provided in STIX 2.1 format. You find an 'Identity' object being used to attribute the campaign. What is the most common use of the 'Identity' object in this context?

Question 24mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are implementing a TIP and want to prioritize intelligence based on the source's reputation. Where should you configure this logic?

Question 25mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are mapping a threat report to the MITRE ATT&CK framework. You have identified that the attacker uses 'PowerShell' to execute commands. Which category should this be mapped to?

Question 26easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are disseminating a report. You want to ensure that the recipients understand the sensitivity of the information. What is the most effective way to communicate this standard?

Question 27hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which THREE of the following are valid Traffic Light Protocol (TLP) labels?

Question 28mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which TWO types of intelligence are primarily categorized as 'Tactical' in nature?

Question 29hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which THREE of the following are security best practices for managing a TAXII server?

Question 30mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which THREE of the following are core components of the STIX 2.1 Domain Object (SDO) structure?

Question 31mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which TWO of the following are necessary to include when creating a high-quality threat intelligence report for an operational team?

Question 32mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which TWO of the following are common challenges when sharing intelligence between organizations?

Question 33mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are configuring a TAXII 2.1 client to consume feeds from an industry ISAC. You have successfully authenticated but are receiving empty response bodies for your collections. Which configuration setting should you verify in the TAXII client to ensure you are polling the correct resource path?

Question 34hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are troubleshooting an issue where a SIEM cannot parse an incoming STIX 2.1 bundle. The bundle contains a 'Relationship' object linking a 'Malware' object to an 'Infrastructure' object. Which property within the 'Relationship' object must be verified to ensure the link type is recognized by the parser?

Question 35hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

When disseminating intelligence to C-level executives versus technical SOC analysts, you must adjust your reporting format. Which technique ensures compliance with intelligence cycle requirements for 'Actionable Intelligence'?

Question 36easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

A regulatory body requires your firm to report incidents using the 'Admiralty Code' for source reliability and information credibility. If you receive a report from a highly trusted partner that has been verified through multiple independent sources, which code should you assign?

Question 37hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

When preparing a STIX 2.1 bundle for sharing via TAXII, which THREE of the following fields are strictly required for an 'Indicator' SDO to be considered 'well-formed'?

Question 38mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are selecting a format for sharing intelligence with a heterogeneous group of partners. Which THREE of the following are benefits of choosing STIX/TAXII over unstructured CSV/PDF reporting?

Question 39hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are drafting a threat intelligence report for an internal audience that includes both technical staff and non-technical executives. The report contains actionable indicators and a strategic assessment. Which intelligence reporting approach best serves this mixed audience?

Question 40easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are an intelligence analyst tasked with disseminating a tactical threat report to your organization's security operations center (SOC). The report includes specific indicators of compromise (IOCs) and recommended detection rules. Which dissemination method is most appropriate to ensure the SOC can rapidly ingest and act on the IOCs?

Question 41mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst preparing a weekly intelligence summary for your organization's executive leadership. The report will include a high-level overview of the current threat landscape, key risks, and recommended strategic actions. To ensure the report is actionable and aligns with the audience's needs, which of the following should be the primary focus of the report?

Question 42hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are a threat intelligence analyst at a financial institution. Your team is preparing to share a report on a recent ransomware campaign with a trusted partner via a TAXII 2.1 collection. To ensure the report is correctly interpreted and the sharing complies with internal policies, which two actions must you take before dissemination? (Choose two.)

Question 43mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are the lead CTI analyst at a financial services firm. After a recent breach, you must deliver a threat intelligence report to the board of directors. The board has limited technical background but needs to understand the business impact and make risk-based decisions. Which reporting approach is most appropriate for this audience?

Question 44easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are an intelligence analyst tasked with disseminating a tactical threat intelligence report to your organization's SOC analysts. The report contains specific IOCs and TTPs that need to be acted upon quickly. Which dissemination method is most appropriate for ensuring timely and actionable delivery to the SOC?

Question 45hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst preparing to share a report with a partner organization. The report contains sensitive technical details about an ongoing investigation. You want to ensure the information is shared only with the intended recipients and that they understand the handling restrictions. Which action best fulfills this requirement?

Question 46mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a threat intelligence analyst at a financial services firm. After a recent intrusion, you need to produce a report for the board of directors that explains the likely threat actor, their motivation, and potential business impact. Which reporting format is most appropriate for this audience?

Question 47mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst at a multinational corporation. You have produced a strategic intelligence report assessing the long-term threat posed by a nation-state actor targeting your industry. The report includes sensitive details about your organization's defensive posture. You need to share it with your subsidiary in a foreign country. Which TLP marking should you apply to ensure the information is shared appropriately while protecting your organization's interests?

Question 48mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

A threat intelligence analyst is creating a weekly report for the security operations center (SOC). The report includes a list of IP addresses associated with a recent phishing campaign. The analyst wants to ensure the report is actionable and prioritized for the SOC team. Which of the following should be included to best support immediate action?

Question 49mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst tasked with creating a threat intelligence report for your organization's security operations center (SOC). The SOC team needs to quickly detect and respond to a newly identified adversary campaign. Which two elements are most critical to include in this report? (Choose two.)

Question 50mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

An intelligence analyst is preparing a report to be shared with a partner organization under the Traffic Light Protocol (TLP). The report contains threat indicators and analysis. Which TWO of the following are required to ensure proper TLP handling and dissemination? (Choose two.)

Question 51hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are responsible for disseminating threat intelligence to both technical and non-technical stakeholders within your organization. To ensure effective communication, which two of the following practices should you follow? (Choose two.)

Question 52hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are an intelligence analyst preparing a report on a new malware variant. You have obtained technical details from a trusted partner under TLP:AMBER. You need to include these details in an internal report for your organization's incident response team. Which of the following is the most appropriate way to handle the TLP:AMBER information in your internal report?

Question 53easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

A threat intelligence analyst is drafting a report for external dissemination. The report includes indicators of compromise (IOCs) that are marked TLP:GREEN. Which of the following best describes the permitted sharing scope for this report?

Question 54mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

An analyst is preparing a threat intelligence report that includes a new malware family's capabilities and infrastructure. The report is intended for a closed group of trusted partners under TLP:AMBER. Which of the following is the most critical element to include to ensure the report is both actionable and compliant?

Question 55mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst responsible for disseminating a finished intelligence report to multiple stakeholders within your organization, including the SOC, the vulnerability management team, and the CISO. The report contains both tactical indicators and strategic recommendations. What is the most effective way to structure the dissemination to ensure each stakeholder receives the relevant information?

Question 56mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are an analyst at a government agency. You need to share a threat intelligence report with a trusted partner in the private sector. The report contains indicators that are sensitive and should not be shared publicly. Which dissemination method is most appropriate?

Question 57hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a threat intelligence analyst and have just finished writing a report on a new malware campaign. Before disseminating it, you need to ensure the report meets the criteria for actionable intelligence. Which of the following best describes actionable intelligence?

Question 58mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst at a healthcare provider. After producing a tactical report on a ransomware campaign, you must disseminate it to internal SOC analysts and external partners. The report contains a mix of strategic assessments and technical indicators. Which dissemination method best balances timeliness, security, and audience needs?

Question 59hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst preparing a strategic intelligence report for your organization's executive committee. The report assesses a nation-state threat group's long-term intentions and capabilities. Which two actions are most appropriate to ensure the report effectively supports executive decision-making? (Choose two.)

Question 60easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst and need to share a report marked TLP:AMBER with a trusted partner. What is the correct handling procedure for this report?

Question 61mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst tasked with disseminating a finished intelligence report to a non-English-speaking partner. The report contains technical indicators and strategic assessments. Which dissemination consideration is most critical to ensure the partner can effectively use the intelligence?

Question 62hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst preparing to disseminate a report that includes indicators attributed to a specific nation-state actor. Your organization's legal team advises that sharing these indicators could reveal sensitive sources and methods. Which dissemination strategy best balances the need to inform stakeholders with the need to protect sources?

Question 1easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

Your organization uses a TIP (Threat Intelligence Platform) to ingest STIX feeds. You notice that the ingest process is failing specifically for feeds sourced from an older platform using STIX 1.2. Why is this occurring?

Question 2mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are configuring a TAXII 2.1 server to share threat indicators with a government partner. You need to ensure the connection enforces the transport-level security requirements for sensitive data exchange. Which setting must you verify in the TAXII configuration?

Question 3hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

When setting up a TAXII 2.1 client, which THREE settings are mandatory for establishing a successful connection to a server?

Question 4hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which THREE of the following are valid reasons to use the STIX 'Sighting' object?

Question 5easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

Your organization is mandated to share threat indicators under the Traffic Light Protocol (TLP). Which TLP marking indicates that the information can be shared with peers within the sector but should not be distributed publicly?

Question 6mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are drafting a STIX 2.1 'Observed-Data' object to report an IP address involved in a recent exfiltration event. To maintain standard compliance for automated ingestion, which property is mandatory to define the temporal scope of the observation?

Question 7mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are integrating a new threat intelligence platform (TIP). You need to define a 'Custom Object' in STIX 2.1 to track a specific internal project codename associated with threat actors. Which prefix must be used for the custom object name to ensure compatibility and avoid collisions?

Question 8mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are auditing your TAXII server configuration for data sharing compliance. Which TWO of the following items must be explicitly defined for each collection to ensure correct data governance and access control?

Question 9mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are preparing a threat intelligence report to be shared with a partner organization under the Traffic Light Protocol (TLP). The report includes indicators of compromise and contextual analysis. Which two actions should you take to ensure proper dissemination and handling? (Choose two.)

Question 10hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

An analyst is preparing a threat intelligence report for the CISO that includes a detailed technical analysis of a new malware variant. The report contains specific IOCs and TTPs, and the organization wants to share it with a trusted partner under TLP:AMBER. However, the partner is a commercial entity, not a government agency. Which dissemination method is most appropriate to ensure compliance with TLP:AMBER?

Question 11easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst at a healthcare organization. You have received a threat intelligence report from a trusted partner. The report is marked TLP:AMBER. According to the Traffic Light Protocol, how should you handle this information?

Question 12easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a threat intelligence analyst preparing to share a report with a partner organization. The report contains information that should only be shared within your two organizations and not with any third parties. Which TLP marking should you apply?

Question 13hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are troubleshooting a synchronization issue between two threat intelligence platforms. One platform is configured for TAXII 2.1 and the other is receiving the data but failing to parse the STIX 2.1 bundle. Which diagnostic step is most appropriate?

Question 14hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

An analyst is mapping internal incident data to STIX 2.1 objects. You need to link a specific threat actor to the infrastructure they recently utilized. Which object type should you use to link the 'Threat-Actor' object to the 'Infrastructure' object?

Question 15mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are drafting an executive threat report and need to adhere to the Traffic Light Protocol (TLP). The report contains sensitive information about an ongoing vulnerability in a zero-day exploit that could cause irreparable damage if leaked. Which TLP color should be applied?

Question 16hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

When setting up a TAXII 2.1 Collection in a commercial TIP, you are asked to provide a 'Collection ID'. What is the primary purpose of this identifier?

Question 17mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are integrating a new threat intel feed that provides 'Course of Action' (CoA) objects. What is the intended use of this STIX object type in an automated environment?

Question 18easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

A CISO asks for a report that provides a strategic outlook on the threat landscape for the upcoming quarter. What format is most appropriate for this type of audience?

Question 19hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

An organization wants to contribute intelligence to an ISAC (Information Sharing and Analysis Center). They need to ensure their sharing mechanism supports automated, near-real-time updates. Which standard should they adopt?

Question 20easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

When preparing a report for a SOC team, which metric is most important to include to prove the intelligence is actionable?

Question 21easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

Which regulatory framework should a company consider when sharing threat intelligence that contains PII (Personally Identifiable Information) with international partners?

Question 22hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

A threat intelligence report uses the Diamond Model for Intrusion Analysis. You are adding a new 'Victim' node. What information should you include to align with this model?

Question 23mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are analyzing an intelligence report provided in STIX 2.1 format. You find an 'Identity' object being used to attribute the campaign. What is the most common use of the 'Identity' object in this context?

Question 24mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are implementing a TIP and want to prioritize intelligence based on the source's reputation. Where should you configure this logic?

Question 25mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are mapping a threat report to the MITRE ATT&CK framework. You have identified that the attacker uses 'PowerShell' to execute commands. Which category should this be mapped to?

Question 26easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are disseminating a report. You want to ensure that the recipients understand the sensitivity of the information. What is the most effective way to communicate this standard?

Question 27hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which THREE of the following are valid Traffic Light Protocol (TLP) labels?

Question 28mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which TWO types of intelligence are primarily categorized as 'Tactical' in nature?

Question 29hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which THREE of the following are security best practices for managing a TAXII server?

Question 30mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which THREE of the following are core components of the STIX 2.1 Domain Object (SDO) structure?

Question 31mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which TWO of the following are necessary to include when creating a high-quality threat intelligence report for an operational team?

Question 32mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

Which TWO of the following are common challenges when sharing intelligence between organizations?

Question 33mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are configuring a TAXII 2.1 client to consume feeds from an industry ISAC. You have successfully authenticated but are receiving empty response bodies for your collections. Which configuration setting should you verify in the TAXII client to ensure you are polling the correct resource path?

Question 34hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are troubleshooting an issue where a SIEM cannot parse an incoming STIX 2.1 bundle. The bundle contains a 'Relationship' object linking a 'Malware' object to an 'Infrastructure' object. Which property within the 'Relationship' object must be verified to ensure the link type is recognized by the parser?

Question 35hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

When disseminating intelligence to C-level executives versus technical SOC analysts, you must adjust your reporting format. Which technique ensures compliance with intelligence cycle requirements for 'Actionable Intelligence'?

Question 36easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

A regulatory body requires your firm to report incidents using the 'Admiralty Code' for source reliability and information credibility. If you receive a report from a highly trusted partner that has been verified through multiple independent sources, which code should you assign?

Question 37hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

When preparing a STIX 2.1 bundle for sharing via TAXII, which THREE of the following fields are strictly required for an 'Indicator' SDO to be considered 'well-formed'?

Question 38mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are selecting a format for sharing intelligence with a heterogeneous group of partners. Which THREE of the following are benefits of choosing STIX/TAXII over unstructured CSV/PDF reporting?

Question 39hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are drafting a threat intelligence report for an internal audience that includes both technical staff and non-technical executives. The report contains actionable indicators and a strategic assessment. Which intelligence reporting approach best serves this mixed audience?

Question 40easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are an intelligence analyst tasked with disseminating a tactical threat report to your organization's security operations center (SOC). The report includes specific indicators of compromise (IOCs) and recommended detection rules. Which dissemination method is most appropriate to ensure the SOC can rapidly ingest and act on the IOCs?

Question 41mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst preparing a weekly intelligence summary for your organization's executive leadership. The report will include a high-level overview of the current threat landscape, key risks, and recommended strategic actions. To ensure the report is actionable and aligns with the audience's needs, which of the following should be the primary focus of the report?

Question 42hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are a threat intelligence analyst at a financial institution. Your team is preparing to share a report on a recent ransomware campaign with a trusted partner via a TAXII 2.1 collection. To ensure the report is correctly interpreted and the sharing complies with internal policies, which two actions must you take before dissemination? (Choose two.)

Question 43mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are the lead CTI analyst at a financial services firm. After a recent breach, you must deliver a threat intelligence report to the board of directors. The board has limited technical background but needs to understand the business impact and make risk-based decisions. Which reporting approach is most appropriate for this audience?

Question 44easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are an intelligence analyst tasked with disseminating a tactical threat intelligence report to your organization's SOC analysts. The report contains specific IOCs and TTPs that need to be acted upon quickly. Which dissemination method is most appropriate for ensuring timely and actionable delivery to the SOC?

Question 45hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst preparing to share a report with a partner organization. The report contains sensitive technical details about an ongoing investigation. You want to ensure the information is shared only with the intended recipients and that they understand the handling restrictions. Which action best fulfills this requirement?

Question 46mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a threat intelligence analyst at a financial services firm. After a recent intrusion, you need to produce a report for the board of directors that explains the likely threat actor, their motivation, and potential business impact. Which reporting format is most appropriate for this audience?

Question 47mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst at a multinational corporation. You have produced a strategic intelligence report assessing the long-term threat posed by a nation-state actor targeting your industry. The report includes sensitive details about your organization's defensive posture. You need to share it with your subsidiary in a foreign country. Which TLP marking should you apply to ensure the information is shared appropriately while protecting your organization's interests?

Question 48mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

A threat intelligence analyst is creating a weekly report for the security operations center (SOC). The report includes a list of IP addresses associated with a recent phishing campaign. The analyst wants to ensure the report is actionable and prioritized for the SOC team. Which of the following should be included to best support immediate action?

Question 49mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst tasked with creating a threat intelligence report for your organization's security operations center (SOC). The SOC team needs to quickly detect and respond to a newly identified adversary campaign. Which two elements are most critical to include in this report? (Choose two.)

Question 50mediummulti select

Read the full Intelligence Reporting And Dissemination explanation →

An intelligence analyst is preparing a report to be shared with a partner organization under the Traffic Light Protocol (TLP). The report contains threat indicators and analysis. Which TWO of the following are required to ensure proper TLP handling and dissemination? (Choose two.)

Question 51hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are responsible for disseminating threat intelligence to both technical and non-technical stakeholders within your organization. To ensure effective communication, which two of the following practices should you follow? (Choose two.)

Question 52hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are an intelligence analyst preparing a report on a new malware variant. You have obtained technical details from a trusted partner under TLP:AMBER. You need to include these details in an internal report for your organization's incident response team. Which of the following is the most appropriate way to handle the TLP:AMBER information in your internal report?

Question 53easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

A threat intelligence analyst is drafting a report for external dissemination. The report includes indicators of compromise (IOCs) that are marked TLP:GREEN. Which of the following best describes the permitted sharing scope for this report?

Question 54mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

An analyst is preparing a threat intelligence report that includes a new malware family's capabilities and infrastructure. The report is intended for a closed group of trusted partners under TLP:AMBER. Which of the following is the most critical element to include to ensure the report is both actionable and compliant?

Question 55mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst responsible for disseminating a finished intelligence report to multiple stakeholders within your organization, including the SOC, the vulnerability management team, and the CISO. The report contains both tactical indicators and strategic recommendations. What is the most effective way to structure the dissemination to ensure each stakeholder receives the relevant information?

Question 56mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are an analyst at a government agency. You need to share a threat intelligence report with a trusted partner in the private sector. The report contains indicators that are sensitive and should not be shared publicly. Which dissemination method is most appropriate?

Question 57hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a threat intelligence analyst and have just finished writing a report on a new malware campaign. Before disseminating it, you need to ensure the report meets the criteria for actionable intelligence. Which of the following best describes actionable intelligence?

Question 58mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst at a healthcare provider. After producing a tactical report on a ransomware campaign, you must disseminate it to internal SOC analysts and external partners. The report contains a mix of strategic assessments and technical indicators. Which dissemination method best balances timeliness, security, and audience needs?

Question 59hardmulti select

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst preparing a strategic intelligence report for your organization's executive committee. The report assesses a nation-state threat group's long-term intentions and capabilities. Which two actions are most appropriate to ensure the report effectively supports executive decision-making? (Choose two.)

Question 60easymultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst and need to share a report marked TLP:AMBER with a trusted partner. What is the correct handling procedure for this report?

Question 61mediummultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst tasked with disseminating a finished intelligence report to a non-English-speaking partner. The report contains technical indicators and strategic assessments. Which dissemination consideration is most critical to ensure the partner can effectively use the intelligence?

Question 62hardmultiple choice

Read the full Intelligence Reporting And Dissemination explanation →

You are a CTI analyst preparing to disseminate a report that includes indicators attributed to a specific nation-state actor. Your organization's legal team advises that sharing these indicators could reveal sensitive sources and methods. Which dissemination strategy best balances the need to inform stakeholders with the need to protect sources?