312-85 Intelligence Reporting And Dissemination Practice Test 4 — 15 Questions

Question 1

You are a threat intelligence analyst at a financial services firm. After a recent intrusion, you need to produce a report for the board of directors that explains the likely threat actor, their motivation, and potential business impact. Which reporting format is most appropriate for this audience?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A strategic intelligence report focusing on trends, risks, and business implications.. A strategic intelligence report is tailored for executive audiences, providing context on threat actors, their motivations, and potential business impact without overwhelming technical details. This format enables the board to make informed decisions about risk management and resource allocation. The other options are too technical or operational and do not serve the board's need for high-level, decision-focused intelligence.

Answer

An operational intelligence report detailing the TTPs used by the threat actor.

Answer

A tactical intelligence report listing IP addresses, domains, and file hashes.

Answer

A technical intelligence report with packet captures and malware analysis.

Question 2

You are a CTI analyst at a multinational corporation. You have produced a strategic intelligence report assessing the long-term threat posed by a nation-state actor targeting your industry. The report includes sensitive details about your organization's defensive posture. You need to share it with your subsidiary in a foreign country. Which TLP marking should you apply to ensure the information is shared appropriately while protecting your organization's interests?

Accepted Answer

TLP:AMBER. TLP:AMBER is designed for information that should be shared within the organization and with clients or subsidiaries as needed. It protects sensitive details while enabling necessary operational action. TLP:RED is too restrictive, while TLP:GREEN and TLP:CLEAR are too permissive for this scenario.

Answer

TLP:CLEAR

Answer

TLP:RED

Answer

TLP:GREEN

Question 3

A threat intelligence analyst is creating a weekly report for the security operations center (SOC). The report includes a list of IP addresses associated with a recent phishing campaign. The analyst wants to ensure the report is actionable and prioritized for the SOC team. Which of the following should be included to best support immediate action?

Accepted Answer

The IP addresses with context on their role (e.g., command-and-control, phishing site) and recommended actions (e.g., block, monitor).. For immediate action, the SOC requires tactical intelligence that is specific and prioritized. IP addresses with their role in the campaign and clear recommended actions enable quick decision-making and response. Strategic context or links to external resources, while useful, do not provide the direct, actionable guidance needed for time-sensitive mitigation.

Answer

A link to the full threat intelligence platform (TIP) entry for each IP address for self-service investigation.

Answer

A detailed explanation of the phishing campaign's origin and threat actor motivations.

Answer

A summary of the threat landscape and how this campaign fits into broader trends.

Question 4

You are a CTI analyst tasked with creating a threat intelligence report for your organization's security operations center (SOC). The SOC team needs to quickly detect and respond to a newly identified adversary campaign. Which two elements are most critical to include in this report? (Choose two.)

Accepted Answer

MITRE ATT&CK techniques and tactics used by the adversary.. IOCs and MITRE ATT&CK techniques are critical for SOC detection and response. IOCs provide specific artifacts to hunt for, while ATT&CK mappings describe adversary behaviors, enabling comprehensive defense. Other elements like geopolitical context or policy recommendations are valuable for different audiences but do not directly support the SOC's operational needs.

Answer

Recommendations for strategic policy changes to the board.

Answer

A detailed narrative of the adversary's geopolitical motivations.

Answer

A comprehensive list of all threat actors known to use similar TTPs.

Question 5

An intelligence analyst is preparing a report to be shared with a partner organization under the Traffic Light Protocol (TLP). The report contains threat indicators and analysis. Which TWO of the following are required to ensure proper TLP handling and dissemination? (Choose two.)

Accepted Answer

Ensure the recipient has a need to know and is authorized to receive information at that TLP level.. Proper TLP handling requires clear marking of the TLP level and ensuring recipients are authorized and have a need to know. These two actions are fundamental to comply with TLP and prevent unauthorized disclosure. Encryption, disclaimers, and written permission are not TLP requirements and may be additional measures depending on the situation.

Answer

Include a disclaimer that the information is provided 'as is' without warranty.

Answer

Obtain written permission from the original source before sharing with the partner.

Answer

Encrypt the report using PGP before sending it via email.

Question 6

You are responsible for disseminating threat intelligence to both technical and non-technical stakeholders within your organization. To ensure effective communication, which two of the following practices should you follow? (Choose two.)

Accepted Answer

Tailor the level of technical detail to the audience's expertise and role.. Effective dissemination requires tailoring the content to the audience's expertise and using standardized, clear formats to avoid ambiguity. These practices ensure that intelligence is both understandable and actionable for different stakeholders. Including all raw data, using a single channel, or delaying for completeness can reduce the effectiveness and timeliness of the intelligence, making those options incorrect.

Answer

Disseminate only through a single channel to maintain control over the information.

Answer

Delay dissemination until all information is verified and complete to avoid inaccuracies.

Answer

Include all raw data and indicators in every report to ensure completeness.

Question 7

You are an intelligence analyst preparing a report on a new malware variant. You have obtained technical details from a trusted partner under TLP:AMBER. You need to include these details in an internal report for your organization's incident response team. Which of the following is the most appropriate way to handle the TLP:AMBER information in your internal report?

Accepted Answer

Include the information and clearly mark the specific section with TLP:AMBER, while the rest of the report can have a different TLP marking if appropriate.. TLP markings should be applied to the specific information that is sensitive, not necessarily the entire document. Section-level marking with TLP:AMBER ensures the partner's restrictions are honored while allowing other parts of the report to be shared appropriately. Removing or omitting markings violates the sharing agreement.

Answer

Include the information without any TLP marking because it is for internal use only.

Answer

Include the information verbatim and mark the entire internal report as TLP:AMBER.

Answer

Include the information but remove the TLP marking to avoid confusing internal readers.

Question 8

A threat intelligence analyst is drafting a report for external dissemination. The report includes indicators of compromise (IOCs) that are marked TLP:GREEN. Which of the following best describes the permitted sharing scope for this report?

Accepted Answer

The report can be shared within the recipient's organization and with peers in the same community, but not via public channels.. TLP:GREEN permits sharing within the community, which includes peers and partner organizations, but prohibits public release. This allows for broad but controlled dissemination to those who can use the information for defense. It is less restrictive than TLP:AMBER but more controlled than TLP:CLEAR, making it suitable for information that can be shared widely but not openly.

Answer

The report can be shared with government agencies only.

Answer

The report can be shared only with individuals who have a specific need to know within the recipient's organization.

Answer

The report can be shared publicly without restriction.

Question 9

An analyst is preparing a threat intelligence report that includes a new malware family's capabilities and infrastructure. The report is intended for a closed group of trusted partners under TLP:AMBER. Which of the following is the most critical element to include to ensure the report is both actionable and compliant?

Accepted Answer

A clear TLP:AMBER marking on every page and a statement of handling restrictions.. When disseminating under TLP:AMBER, the most critical element is proper marking and communication of handling restrictions. This ensures recipients understand the sharing limitations and comply with the protocol. While actionable content like IOCs is important, without TLP compliance, the report could be mishandled, leading to unauthorized disclosure and loss of trust.

Answer

A detailed attribution to a specific threat actor group with supporting evidence.

Answer

A recommendation to share the report widely within the partner's industry to maximize defense.

Answer

A list of all IOCs with high confidence scores and detection signatures.

Question 10

You are a CTI analyst responsible for disseminating a finished intelligence report to multiple stakeholders within your organization, including the SOC, the vulnerability management team, and the CISO. The report contains both tactical indicators and strategic recommendations. What is the most effective way to structure the dissemination to ensure each stakeholder receives the relevant information?

Accepted Answer

Create separate tailored reports for each stakeholder group, emphasizing the aspects most relevant to their roles.. Tailored reports for each stakeholder group ensure that the SOC gets tactical indicators, the vulnerability management team receives relevant vulnerability data, and the CISO gets strategic recommendations. This maximizes the utility of the intelligence and supports timely, role-specific actions. Other approaches risk information overload or omission of critical details for certain audiences.

Answer

Disseminate only the tactical indicators to all stakeholders, as they are the most actionable.

Answer

Send the full report to all stakeholders, allowing them to extract the information pertinent to their roles.

Answer

Hold a single briefing meeting where you present the entire report to all stakeholders simultaneously.

Question 11

You are an analyst at a government agency. You need to share a threat intelligence report with a trusted partner in the private sector. The report contains indicators that are sensitive and should not be shared publicly. Which dissemination method is most appropriate?

Accepted Answer

Send the report via encrypted email to the specific partner contact.. Encrypted email to a specific partner contact is the most appropriate method because it ensures the report is delivered only to the intended recipient and protects it during transmission. Public posting, closed mailing lists, and public file-sharing services either violate TLP restrictions or lack the necessary security controls. This method balances confidentiality and timeliness, aligning with best practices for disseminating sensitive threat intelligence.

Answer

Post the report on a public-facing website with a TLP:RED marking.

Answer

Share the report on a closed industry mailing list with TLP:GREEN.

Answer

Upload the report to a public file-sharing service and send the link to the partner.

Question 12

You are a threat intelligence analyst and have just finished writing a report on a new malware campaign. Before disseminating it, you need to ensure the report meets the criteria for actionable intelligence. Which of the following best describes actionable intelligence?

Accepted Answer

Intelligence that is timely, accurate, specific, and provides clear guidance for action.. Actionable intelligence is characterized by timeliness, accuracy, specificity, and clear guidance for action. These attributes ensure that the intelligence can be used to make informed decisions and take effective measures. A list of IOCs, classification level, or production method alone does not guarantee actionability. The focus should be on providing context and recommendations that enable the recipient to act.

Answer

Intelligence that is produced using automated tools and machine learning algorithms.

Answer

Intelligence that includes a comprehensive list of all known IOCs related to the campaign.

Answer

Intelligence that is classified as top secret and shared only with cleared personnel.

Question 13

You are a CTI analyst at a healthcare provider. After producing a tactical report on a ransomware campaign, you must disseminate it to internal SOC analysts and external partners. The report contains a mix of strategic assessments and technical indicators. Which dissemination method best balances timeliness, security, and audience needs?

Accepted Answer

Use a secure sharing platform with role-based access and TLP markings, distributing tailored versions to each audience.. The correct approach uses a secure platform with role-based access and TLP markings, ensuring that sensitive information reaches only authorized recipients. Tailoring content for different audiences—technical for SOC analysts, strategic for partners—enhances relevance and actionability. This method satisfies confidentiality, timeliness, and audience-specific needs, which are critical in disseminating threat intelligence effectively.

Answer

Deliver printed copies in person to each recipient's office.

Answer

Post the report on a public-facing website for easy access.

Answer

Send the full report via unencrypted email to all recipients.

Question 14

You are a CTI analyst preparing a strategic intelligence report for your organization's executive committee. The report assesses a nation-state threat group's long-term intentions and capabilities. Which two actions are most appropriate to ensure the report effectively supports executive decision-making? (Choose two.)

Accepted Answer

Provide clear, actionable recommendations linked to business risks and strategic goals.. Executives require intelligence that is linked to business risks and strategic goals, with clear recommendations and transparent confidence levels. Including raw IOCs or focusing solely on TTPs does not serve strategic decision-making. Omitting uncertainty creates a false sense of certainty. Thus, actionable recommendations and probabilistic language are the most appropriate for executive audiences.

Answer

Omit any mention of uncertainty to present a confident, decisive assessment.

Answer

Include a detailed appendix of raw indicators of compromise (IOCs) for technical staff.

Answer

Focus exclusively on the technical tactics, techniques, and procedures (TTPs) of the threat group.

Question 15

You are a CTI analyst and need to share a report marked TLP:AMBER with a trusted partner. What is the correct handling procedure for this report?

Accepted Answer

Share it only with individuals within your organization and the partner's organization who need to know.. TLP:AMBER designates information that can be shared within the recipient's organization and with clients on a need-to-know basis. It does not permit public release or unrestricted internal distribution. The correct procedure is to share only with those who require the information to perform their duties, ensuring both utility and confidentiality.

Answer

Share it with anyone in the partner's organization, including all employees.

Answer

Share it publicly on your organization's website.

Answer

Share it with the partner only if they agree to keep it secret indefinitely.