312-85 Requirements Planning Direction And Review — 20 Questions

Question 1

During program planning for a threat intelligence capability, the security team maps their intelligence processes to the NIST Cybersecurity Framework (CSF). Which CSF function is most directly aligned with establishing Threat Intelligence requirements, gathering sources, and reviewing intelligence collection efficacy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identify (ID). The NIST CSF 'Govern' (GV) and 'Identify' (ID) functions encompass the establishment of policies, procedures, and asset/threat identification, with ID.RA (Risk Assessment) and GV subcategories guiding intelligence requirement definition.

Answer

Recover (RC)

Answer

Respond (RS)

Answer

Protect (PR)

Question 2

When structuring a Threat Intelligence program, a CTI leader must establish structured analytic techniques to overcome cognitive biases during analysis. Which THREE are recognized structured analytic techniques used in intelligence analysis? (Choose THREE)

Accepted Answer

Devil's Advocacy. Analysis of Competing Hypotheses (ACH), Red Hat Analysis, and Devil's Advocacy are standard structured analytic techniques.

Answer

Symmetric Key Cryptographic Padding

Answer

Randomized MAC Address Rotation

Question 3

A financial services CTI team has completed its first year and the intelligence manager must now establish a formal Intelligence Requirements Review Board (IRRB) to continuously govern requirements. She wants the board to perform the core review functions that keep requirements relevant and prioritized. Which THREE activities should the IRRB perform on a recurring basis? (Choose three.)

Accepted Answer

Reassess whether each existing requirement still maps to a current business or security objective and retire requirements whose consumers no longer need them. An Intelligence Requirements Review Board exists to keep requirements alive and aligned, so it periodically re-validates that each requirement still supports a current business objective, re-ranks requirements when threat or business conditions change, and collects and analyzes reporting against approved requirements to test whether they are being satisfied. Detection rule tuning and budget approval are operational or executive functions outside the board's requirements-governance scope.

Answer

Approve the annual cybersecurity budget and sign off on vendor contract renewals for the security organization

Answer

Configure firewall and EDR detection rules so that indicators produced by the team are enforced on perimeter and endpoint controls

Question 4

During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?

Accepted Answer

To define specific information needs that support organizational decision-making and risk reduction. Priority Intelligence Requirements (PIRs) are the specific, decision-relevant intelligence questions that drive collection and analysis. Defining them during Requirements Planning ensures the CTI program produces intelligence that supports organizational decision-making and risk reduction, rather than unfocused data gathering.

Answer

To schedule routine penetration testing intervals across the enterprise network

Answer

To outline the budget allocation for commercial threat feed subscriptions

Answer

To establish automated firewall blocklists for known malicious IP addresses

Question 5

A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?

Accepted Answer

Capability. In the Diamond Model, the four core vertices are Adversary, Capability, Infrastructure, and Victim. Capability represents the tools and techniques (TTPs) used by the adversary.

Answer

Infrastructure

Answer

Adversary

Answer

Victim

Question 6

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

Accepted Answer

Triage, validate, and prioritize the RFI against established intelligence priorities. In the direction phase of the intelligence lifecycle, RFIs submitted by operational teams must go through a structured management process. The correct next step is to triage the RFI (assess its urgency and scope), validate it (confirm it aligns with collection capabilities and is a legitimate intelligence requirement), and prioritize it against established Priority Intelligence Requirements (PIRs). This ensures collection and analysis resources are directed toward the most mission-critical questions rather than ad-hoc operational noise.

Answer

Immediately publish the raw telemetry to the corporate intranet without validation

Answer

Archive the RFI immediately as operational queries fall outside the scope of CTI

Answer

Initiate an immediate red-team attack campaign against the external supplier

Question 7

An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?

Accepted Answer

Strategic Threat Intelligence Analyst. The Threat Intelligence Manager or Strategic Threat Analyst bridges the gap between technical threat indicators and business risk, ensuring executive leadership understands the strategic impact.

Answer

Vulnerability Assessor

Answer

Malware Reverse Engineer

Answer

Incident Responder

Question 8

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

Accepted Answer

Standardization of intelligence processes and a unified view of organizational risk. A centralized team allows for better standardization of intelligence processes, resource pooling, and a unified view of the enterprise threat landscape.

Answer

Elimination of the need for external commercial threat feeds

Answer

Complete elimination of communication silos with local IT helpdesks

Answer

Faster deployment of endpoint agents on localized operational technology networks

Question 9

An organization is updating its threat landscape analysis methodology to better account for sector-specific threats. Which stakeholder group should the CTI team primarily consult to gather accurate sector-specific threat requirements?

Accepted Answer

Industry-specific ISACs and regulatory compliance bodies. Industry-specific Information Sharing and Analysis Centers (ISACs) and regulatory compliance bodies are the authoritative sources for sector-specific threat intelligence, providing curated threat feeds, indicators, and best practices tailored to industries like finance (FS-ISAC), healthcare (H-ISAC), and energy (E-ISAC). They also align intelligence requirements with regulatory obligations, ensuring the CTI team's methodology reflects both threat reality and compliance mandates.

Answer

Social media marketing agencies

Answer

Commercial real estate brokers

Answer

Consumer product retail vendors

Question 10

A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?

Accepted Answer

Percentage of intelligence reports that result in actionable security controls or detection rules. Measuring actionable outcomes, such as the percentage of intelligence reports that lead to confirmed threat mitigation or detection rule creation, evaluates quality and relevance.

Answer

Number of threat intelligence blog posts published on the corporate website

Answer

Total gigabytes of threat data ingested from commercial feeds per month

Answer

Total number of security alerts generated by the SIEM

Question 11

An intelligence analyst is tasked with tailoring intelligence requirements for a merger and acquisition (M&A) scenario. Which methodology should be applied during the direction phase to identify threat actors specifically interested in compromising corporate transactions?

Accepted Answer

Target-Centric Intelligence Analysis. Target-centric intelligence analysis focuses specifically on the assets, events, or transactions of interest (such as an M&A deal) and maps out all threat actors known to target those specific equities.

Answer

Network Forensic Packet Capture Analysis

Answer

Signature-Based Intrusion Detection Analysis

Answer

Vulnerability Scoring via CVSS v3.1 Base Metrics

Question 12

During the planning phase of building a CTI team, the program manager needs to define the scope of intelligence operations. Which category of intelligence focuses specifically on technical indicators such as file hashes, IP addresses, and domain names?

Accepted Answer

Tactical Intelligence. Tactical intelligence focuses on immediate, actionable technical indicators — file hashes, IP addresses, domain names, and URLs — that defenders use to detect and block threats in the short term. It is the layer of CTI that feeds SIEM rules, IDS signatures, and blocklists, and it is what most SOC analysts consume daily.

Answer

Financial Intelligence

Answer

Operational Intelligence

Answer

Strategic Intelligence

Question 13

A newly formed CTI team is conducting stakeholder interviews to establish intelligence requirements. The Chief Risk Officer (CRO) expresses concern over ransomware supply chain disruptions. How should the intelligence analyst translate this concern into a formal intelligence requirement?

Accepted Answer

Develop requirements to identify ransomware campaigns, threat actor TTPs, and third-party vendors targeting our critical supply chain ecosystem. Translating executive concerns into formal requirements involves formulating specific, answerable questions regarding supply chain vulnerabilities and active ransomware campaigns targeting third-party vendors.

Answer

Collect all CVEs published daily by the National Vulnerability Database (NVD)

Answer

Deploy endpoint detection and response (EDR) agents to all contractor laptops

Answer

Execute regular phishing simulations for all internal business unit employees

Question 14

An intelligence manager is reviewing the threat intelligence program's intelligence gap analysis. The analysis reveals that the team frequently fails to detect supply chain intrusions until late in the attack lifecycle. Which adjustments to the direction and planning phase should the manager implement?

Accepted Answer

Shift intelligence requirements to focus on initial access vectors, third-party supplier dependencies, and forums frequented by Initial Access Brokers (IABs). Refining collection requirements and pivoting focus toward upstream threat indicators (such as supplier dependencies, third-party vendor risks, and initial access brokers) addresses late detection of supply chain intrusions.

Answer

Disable all external threat intelligence feeds to reduce noise in the security operations center

Answer

Reassign all malware reverse engineering tasks to helpdesk support personnel

Answer

Increase the budget for automated SIEM log retention from 30 days to 90 days

Question 15

During the CTI team building process, the manager needs to hire personnel with analytical mindsets who can avoid cognitive biases. Which cognitive bias involves favoring information that confirms pre-existing beliefs while discarding contradictory evidence?

Accepted Answer

Confirmation Bias. Confirmation bias is the tendency to search for, interpret, favor, and recall information in a way that confirms or supports one's prior beliefs or values.

Answer

Availability Heuristic

Answer

Mirror Imaging

Answer

Bandwagon Effect

Question 16

An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?

Accepted Answer

Information on exploit frameworks, payload construction tools, and customized delivery mechanisms used by target threat groups. Weaponization involves coupling an exploit with a payload (e.g., a PDF or Office document). Collecting intelligence on weaponization involves gathering data on exploit kits, payload templates, and builder tools used by adversaries.

Answer

Phishing email headers received by internal mail servers from external domains

Answer

File hashes and indicators associated with credential dumping tools like Mimikatz

Answer

Network traffic logs showing data exfiltration over encrypted channels

Question 17

An organization is establishing metrics for its Threat Intelligence program review. The CTI director wants to measure 'Collection Efficiency.' Which formula or evaluation method best represents this metric?

Accepted Answer

The ratio of high-value intelligence reports produced that directly answered PIRs versus total raw data collected. Collection Efficiency measures how well the collection process converts raw data into intelligence that answers Priority Intelligence Requirements (PIRs). The ratio of high-value reports that directly answered PIRs to total raw data collected captures this conversion rate — a high ratio means the collection sources are well-targeted and not producing excessive noise. This is the standard CTI metric for evaluating whether collection resources are being used effectively.

Answer

The number of firewall rule changes approved by change management

Answer

The total financial cost of commercial intelligence subscriptions divided by the number of employees

Answer

The average time it takes an analyst to write a quarterly report

Question 18

A CTI program is conducting a formal review of its intelligence requirements to ensure alignment with changing business goals. Which phase of the intelligence cycle directly feeds into the direction and planning phase during this review?

Accepted Answer

Dissemination and Feedback. The intelligence cycle is a closed loop: Direction/Planning sets requirements, Collection gathers raw data, Processing turns it into usable form, Analysis produces intelligence, and Dissemination delivers it to consumers. The Feedback component of Dissemination is what tells planners whether the intelligence answered the original requirements, so it directly feeds back into the next Direction and Planning cycle. During a formal requirements review, this feedback loop is the mechanism that realigns intelligence requirements with evolving business goals.

Answer

Processing and Exploitation

Answer

Automated Malware Sandboxing

Answer

Tactical Log Ingestion

Question 19

During the requirements planning phase, a CTI analyst categorizes intelligence needs based on consumer levels. Which THREE types of intelligence consumers must be addressed in a comprehensive intelligence plan? (Choose THREE)

Accepted Answer

Tactical level (SIEM systems, Automated security controls, SOC analysts). The three correct answers are A, B, and D because a comprehensive intelligence plan must serve all three recognized consumer tiers. Option A, the tactical level (SIEM systems, automated security controls, SOC analysts), is correct because these consumers need immediate, machine-readable and indicator-level intelligence to drive detection, blocking, and alerting in real time. Option B, the strategic level (executive leadership, Board of Directors), is correct because these consumers require high-level, long-term intelligence about risks, trends, and business impact to inform governance, budgeting, and risk decisions. Option D, the operational level (SOC managers, incident responders), is correct because these consumers need campaign-level, contextual intelligence to prioritize investigations, allocate resources, and coordinate response activities. Option C is incorrect because corporate real estate leasing committees are not a standard intelligence consumer category and have no defined role in threat intelligence requirements. Option E is incorrect because external product marketing teams fall outside the organization's security intelligence consumer model and are not part of a CTI plan's defined audience.

Answer

Corporate real estate leasing committees

Answer

External consumer product marketing teams

Question 20

An intelligence manager is evaluating sources for a threat intelligence program during the planning phase. Which TWO criteria are critical when vetting a new external threat intelligence vendor or feed? (Choose TWO)

Accepted Answer

Relevance of the feed data to the organization's specific industry sector and geographic footprint. Option A is correct because a threat intelligence feed must be relevant to the organization's specific industry sector and geographic footprint; intelligence about threats targeting unrelated sectors or regions wastes resources and fails to inform risk-based decisions. Option D is correct because actionability is a core vetting criterion: the intelligence must be timely, contextual, and specific enough to drive concrete updates to security controls such as firewall rules, IDS/IPS signatures, or SIEM detections. Option B is incorrect because a vendor's marketing budget has no bearing on the technical quality, accuracy, or usefulness of its intelligence. Option C is incorrect because publicly sharing all threat data on open-source social media does not indicate vendor quality and may actually reduce the exclusivity and value of the feed. Option E is incorrect because raw volume of unverified IP addresses without regard to false positive rates is a poor metric; high false positives degrade detection fidelity and increase analyst workload.

Answer

The marketing budget of the threat intelligence vendor

Answer

Whether the vendor shares all threat data publicly on open-source social media platforms

Answer

The total number of unverified IP addresses included in the feed without regard to false positive rates