312-85 Requirements Planning Direction And Review — All Questions With Answers

Question 1hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

During program planning for a threat intelligence capability, the security team maps their intelligence processes to the NIST Cybersecurity Framework (CSF). Which CSF function is most directly aligned with establishing Threat Intelligence requirements, gathering sources, and reviewing intelligence collection efficacy?

Question 2hardmulti select

Read the full Requirements Planning Direction And Review explanation →

When structuring a Threat Intelligence program, a CTI leader must establish structured analytic techniques to overcome cognitive biases during analysis. Which THREE are recognized structured analytic techniques used in intelligence analysis? (Choose THREE)

Question 3mediummulti select

Read the full Requirements Planning Direction And Review explanation →

A financial services CTI team has completed its first year and the intelligence manager must now establish a formal Intelligence Requirements Review Board (IRRB) to continuously govern requirements. She wants the board to perform the core review functions that keep requirements relevant and prioritized. Which THREE activities should the IRRB perform on a recurring basis? (Choose three.)

Question 4mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?

Question 5hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?

Question 6mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

Question 7easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?

Question 8easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

Question 9easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

An organization is updating its threat landscape analysis methodology to better account for sector-specific threats. Which stakeholder group should the CTI team primarily consult to gather accurate sector-specific threat requirements?

Question 10mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?

Question 11hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

An intelligence analyst is tasked with tailoring intelligence requirements for a merger and acquisition (M&A) scenario. Which methodology should be applied during the direction phase to identify threat actors specifically interested in compromising corporate transactions?

Question 12easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

During the planning phase of building a CTI team, the program manager needs to define the scope of intelligence operations. Which category of intelligence focuses specifically on technical indicators such as file hashes, IP addresses, and domain names?

Question 13mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A newly formed CTI team is conducting stakeholder interviews to establish intelligence requirements. The Chief Risk Officer (CRO) expresses concern over ransomware supply chain disruptions. How should the intelligence analyst translate this concern into a formal intelligence requirement?

Question 14hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

An intelligence manager is reviewing the threat intelligence program's intelligence gap analysis. The analysis reveals that the team frequently fails to detect supply chain intrusions until late in the attack lifecycle. Which adjustments to the direction and planning phase should the manager implement?

Question 15easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

During the CTI team building process, the manager needs to hire personnel with analytical mindsets who can avoid cognitive biases. Which cognitive bias involves favoring information that confirms pre-existing beliefs while discarding contradictory evidence?

Question 16hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?

Question 17mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

An organization is establishing metrics for its Threat Intelligence program review. The CTI director wants to measure 'Collection Efficiency.' Which formula or evaluation method best represents this metric?

Question 18mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI program is conducting a formal review of its intelligence requirements to ensure alignment with changing business goals. Which phase of the intelligence cycle directly feeds into the direction and planning phase during this review?

Question 19mediummulti select

Read the full Requirements Planning Direction And Review explanation →

During the requirements planning phase, a CTI analyst categorizes intelligence needs based on consumer levels. Which THREE types of intelligence consumers must be addressed in a comprehensive intelligence plan? (Choose THREE)

Question 20hardmulti select

Read the full Requirements Planning Direction And Review explanation →

An intelligence manager is evaluating sources for a threat intelligence program during the planning phase. Which TWO criteria are critical when vetting a new external threat intelligence vendor or feed? (Choose TWO)

Question 21easymulti select

Read the full Requirements Planning Direction And Review explanation →

When establishing a Threat Intelligence program, a manager must outline the core functions of the TI team. Which TWO of the following responsibilities typically fall under a dedicated CTI team's scope? (Choose TWO)

Question 22mediummulti select

Read the full Requirements Planning Direction And Review explanation →

During the threat landscape analysis and requirements gathering process, an organization must identify its critical assets and crown jewels. Which THREE categories represent typical critical assets that should drive intelligence requirements? (Choose THREE)

Question 23easymulti select

Read the full Requirements Planning Direction And Review explanation →

An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)

Question 24mediummulti select

Read the full Requirements Planning Direction And Review explanation →

During program planning for a CTI team, the program manager must define stakeholder engagement protocols. Which THREE stakeholder groups should be actively engaged during the requirements planning and review phases? (Choose THREE)

Question 25hardmulti select

Read the full Requirements Planning Direction And Review explanation →

An organization is conducting a review of its threat intelligence program to assess alignment with intelligence-driven defense models. Which TWO frameworks are widely used to structure threat intelligence planning, collection, and defense operations? (Choose TWO)

Question 26mediummulti select

Read the full Requirements Planning Direction And Review explanation →

When planning a Threat Intelligence program budget, an organization must account for various resource categories. Which THREE resource categories should be included in the CTI program budget plan? (Choose THREE)

Question 27easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

A retail company's newly appointed CTI lead is defining the direction phase for the coming year. The Chief Information Security Officer asks her to document how intelligence requirements will be gathered from the business and turned into a prioritized set of questions the team must answer. Which deliverable best represents the output of the direction phase?

Question 28mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A global manufacturing company is establishing a new CTI program. The CISO wants to ensure that intelligence production remains focused on the organization's most critical business assets and that resources are allocated efficiently. Which of the following should the CTI manager produce FIRST to define the specific intelligence needs that support strategic decision-making?

Question 29mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is defining Intelligence Requirements (IRs) for a new threat intelligence program. The CISO asks the analyst to ensure that the IRs are both actionable and aligned with the organization's risk appetite. Which of the following is the MOST appropriate first step in this process?

Question 30hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is conducting a review of the intelligence program after six months of operation. The review reveals that several PIRs are no longer relevant due to a recent merger and acquisition. The analyst must realign the intelligence requirements with the new business strategy. Which of the following activities should the analyst perform FIRST to ensure the requirements remain effective?

Question 31mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is conducting the direction phase for a new intelligence requirement focused on a persistent threat group targeting the organization's financial systems. The analyst must define the Essential Elements of Information (EEI) to guide collection. Which of the following best describes the purpose of EEIs in this context?

Question 32mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A threat intelligence analyst is assigned to establish a collection plan for a new business unit that has just expanded its operations to the cloud. The analyst needs to determine the most effective source to gather information about threat actors specifically targeting cloud service providers and their attack techniques. Which of the following sources should the analyst prioritize?

Question 33easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI manager is reviewing the team's Priority Intelligence Requirements (PIRs) and notices that they are too broad, making it difficult to focus collection efforts. Which action should the manager take to improve the PIRs?

Question 34hardmulti select

Read the full Requirements Planning Direction And Review explanation →

A CTI manager is reviewing the intelligence requirements after a major business acquisition expanded the organization's presence into new regions. The manager must adjust the requirements to address new risks. Which TWO of the following actions are most appropriate during this review? (Choose two.)

Question 35easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI team is developing its intelligence requirements for the upcoming year. The team lead wants to ensure that the requirements are structured to support both tactical and strategic decision-making. Which of the following best describes the primary purpose of defining Priority Intelligence Requirements (PIRs)?

Question 36hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI manager is conducting a review of the intelligence requirements after a major merger. The organization's priorities have shifted, and the manager must ensure that the collection efforts remain aligned with the new business objectives. Which of the following actions best ensures that the intelligence requirements continue to meet the evolving needs?

Question 37hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is tasked with developing a collection plan to support the organization's intelligence requirements. The analyst must prioritize sources based on reliability, relevance, and cost. Which of the following criteria should be the PRIMARY consideration when selecting sources?

Question 38easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is developing a collection plan to support a new intelligence requirement on ransomware targeting the healthcare sector. The analyst needs to identify the most appropriate type of collection to gather information on ransomware variants and their tactics. Which of the following collection sources is best suited for this requirement?

Question 39mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is tasked with reviewing the effectiveness of the intelligence program. The analyst notices that despite having clear PIRs, the intelligence reports often fail to answer the specific questions posed by decision-makers. Which of the following should the analyst evaluate FIRST to identify the root cause?

Question 40easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

During the direction phase of the intelligence cycle, a CTI analyst receives a request from the Chief Information Security Officer (CISO) for intelligence on a specific threat actor group that has been targeting the organization's industry. The analyst must translate this request into a formal intelligence requirement. Which of the following is the most appropriate first step?

Question 41mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is tasked with producing a threat assessment for the upcoming quarter. The analyst must decide which intelligence requirements to prioritize based on the organization's risk appetite and current threat landscape. Which of the following criteria is most important when prioritizing requirements?

Question 42mediummulti select

Read the full Requirements Planning Direction And Review explanation →

A CTI team is conducting a requirements review with stakeholders to ensure the intelligence program remains aligned with business objectives. Which TWO activities are essential during this review? (Choose two.)

Question 43hardmulti select

Read the full Requirements Planning Direction And Review explanation →

A CTI manager is conducting a formal review of the intelligence program to ensure it remains aligned with business goals. The review will assess the effectiveness of the requirements planning, direction, and review phases. Which TWO activities are essential components of the review phase in the intelligence cycle? (Choose two.)

Question 44mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI team is developing a collection plan for a new intelligence requirement focused on ransomware groups targeting the healthcare sector. The team must select the most relevant sources to gather information on these groups' tactics, techniques, and procedures (TTPs). Which of the following sources would provide the most direct and actionable intelligence for this requirement?

Question 45hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is conducting a review of the intelligence requirements after a series of false positives from automated collection tools. The review aims to refine the requirements to reduce noise. Which of the following actions best addresses this issue?

Question 46mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is developing a set of Specific Intelligence Requirements (SIRs) to support the organization's PIRs. The analyst must ensure that each SIR is measurable and time-bound. Which of the following is the BEST example of a well-formulated SIR?

Question 47hardmulti select

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is tasked with creating a collection plan for a new intelligence requirement focused on advanced persistent threat (APT) actors targeting the organization's cloud infrastructure. The analyst must consider various factors to ensure the plan is effective. Which TWO of the following are essential components of an effective collection plan for this requirement? (Choose two.)

Question 48mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A newly appointed CTI lead at a financial services firm is asked to align the intelligence program with the business’s strategic risk appetite. The executive team wants to know how CTI will support decisions about mergers and acquisitions. Which of the following best describes the primary purpose of defining Priority Intelligence Requirements (PIRs) in this context?

Question 49hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI manager is conducting a requirements review with stakeholders from legal, IT, and business units. During the meeting, the legal team requests intelligence on data breach notification laws in all 50 U.S. states. The CTI team currently has no collection sources for legal research. Which action should the CTI manager take FIRST to address this request?

Question 50easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is drafting intelligence requirements for a new program. The analyst wants to ensure that each requirement is actionable and can be used to guide collection. Which of the following is the most important characteristic of a well-written intelligence requirement?

Question 51mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI team is conducting a periodic review of its intelligence requirements. The team notices that several requirements have not generated any collection or analysis in the past six months. Which of the following is the MOST appropriate action for the team to take?

Question 52mediummulti select

Read the full Requirements Planning Direction And Review explanation →

A CTI manager is developing a collection plan to support a new intelligence requirement on supply chain attacks targeting the organization’s software vendors. The manager needs to identify the types of intelligence sources that should be included. Which THREE of the following are appropriate sources for this collection plan? (Choose three.)

Question 1hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

During program planning for a threat intelligence capability, the security team maps their intelligence processes to the NIST Cybersecurity Framework (CSF). Which CSF function is most directly aligned with establishing Threat Intelligence requirements, gathering sources, and reviewing intelligence collection efficacy?

Question 2hardmulti select

Read the full Requirements Planning Direction And Review explanation →

When structuring a Threat Intelligence program, a CTI leader must establish structured analytic techniques to overcome cognitive biases during analysis. Which THREE are recognized structured analytic techniques used in intelligence analysis? (Choose THREE)

Question 3mediummulti select

Read the full Requirements Planning Direction And Review explanation →

A financial services CTI team has completed its first year and the intelligence manager must now establish a formal Intelligence Requirements Review Board (IRRB) to continuously govern requirements. She wants the board to perform the core review functions that keep requirements relevant and prioritized. Which THREE activities should the IRRB perform on a recurring basis? (Choose three.)

Question 4mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?

Question 5hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?

Question 6mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

Question 7easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?

Question 8easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

Question 9easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

An organization is updating its threat landscape analysis methodology to better account for sector-specific threats. Which stakeholder group should the CTI team primarily consult to gather accurate sector-specific threat requirements?

Question 10mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?

Question 11hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

An intelligence analyst is tasked with tailoring intelligence requirements for a merger and acquisition (M&A) scenario. Which methodology should be applied during the direction phase to identify threat actors specifically interested in compromising corporate transactions?

Question 12easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

During the planning phase of building a CTI team, the program manager needs to define the scope of intelligence operations. Which category of intelligence focuses specifically on technical indicators such as file hashes, IP addresses, and domain names?

Question 13mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A newly formed CTI team is conducting stakeholder interviews to establish intelligence requirements. The Chief Risk Officer (CRO) expresses concern over ransomware supply chain disruptions. How should the intelligence analyst translate this concern into a formal intelligence requirement?

Question 14hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

An intelligence manager is reviewing the threat intelligence program's intelligence gap analysis. The analysis reveals that the team frequently fails to detect supply chain intrusions until late in the attack lifecycle. Which adjustments to the direction and planning phase should the manager implement?

Question 15easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

During the CTI team building process, the manager needs to hire personnel with analytical mindsets who can avoid cognitive biases. Which cognitive bias involves favoring information that confirms pre-existing beliefs while discarding contradictory evidence?

Question 16hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?

Question 17mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

An organization is establishing metrics for its Threat Intelligence program review. The CTI director wants to measure 'Collection Efficiency.' Which formula or evaluation method best represents this metric?

Question 18mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI program is conducting a formal review of its intelligence requirements to ensure alignment with changing business goals. Which phase of the intelligence cycle directly feeds into the direction and planning phase during this review?

Question 19mediummulti select

Read the full Requirements Planning Direction And Review explanation →

During the requirements planning phase, a CTI analyst categorizes intelligence needs based on consumer levels. Which THREE types of intelligence consumers must be addressed in a comprehensive intelligence plan? (Choose THREE)

Question 20hardmulti select

Read the full Requirements Planning Direction And Review explanation →

An intelligence manager is evaluating sources for a threat intelligence program during the planning phase. Which TWO criteria are critical when vetting a new external threat intelligence vendor or feed? (Choose TWO)

Question 21easymulti select

Read the full Requirements Planning Direction And Review explanation →

When establishing a Threat Intelligence program, a manager must outline the core functions of the TI team. Which TWO of the following responsibilities typically fall under a dedicated CTI team's scope? (Choose TWO)

Question 22mediummulti select

Read the full Requirements Planning Direction And Review explanation →

During the threat landscape analysis and requirements gathering process, an organization must identify its critical assets and crown jewels. Which THREE categories represent typical critical assets that should drive intelligence requirements? (Choose THREE)

Question 23easymulti select

Read the full Requirements Planning Direction And Review explanation →

An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)

Question 24mediummulti select

Read the full Requirements Planning Direction And Review explanation →

During program planning for a CTI team, the program manager must define stakeholder engagement protocols. Which THREE stakeholder groups should be actively engaged during the requirements planning and review phases? (Choose THREE)

Question 25hardmulti select

Read the full Requirements Planning Direction And Review explanation →

An organization is conducting a review of its threat intelligence program to assess alignment with intelligence-driven defense models. Which TWO frameworks are widely used to structure threat intelligence planning, collection, and defense operations? (Choose TWO)

Question 26mediummulti select

Read the full Requirements Planning Direction And Review explanation →

When planning a Threat Intelligence program budget, an organization must account for various resource categories. Which THREE resource categories should be included in the CTI program budget plan? (Choose THREE)

Question 27easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

A retail company's newly appointed CTI lead is defining the direction phase for the coming year. The Chief Information Security Officer asks her to document how intelligence requirements will be gathered from the business and turned into a prioritized set of questions the team must answer. Which deliverable best represents the output of the direction phase?

Question 28mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A global manufacturing company is establishing a new CTI program. The CISO wants to ensure that intelligence production remains focused on the organization's most critical business assets and that resources are allocated efficiently. Which of the following should the CTI manager produce FIRST to define the specific intelligence needs that support strategic decision-making?

Question 29mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is defining Intelligence Requirements (IRs) for a new threat intelligence program. The CISO asks the analyst to ensure that the IRs are both actionable and aligned with the organization's risk appetite. Which of the following is the MOST appropriate first step in this process?

Question 30hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is conducting a review of the intelligence program after six months of operation. The review reveals that several PIRs are no longer relevant due to a recent merger and acquisition. The analyst must realign the intelligence requirements with the new business strategy. Which of the following activities should the analyst perform FIRST to ensure the requirements remain effective?

Question 31mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is conducting the direction phase for a new intelligence requirement focused on a persistent threat group targeting the organization's financial systems. The analyst must define the Essential Elements of Information (EEI) to guide collection. Which of the following best describes the purpose of EEIs in this context?

Question 32mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A threat intelligence analyst is assigned to establish a collection plan for a new business unit that has just expanded its operations to the cloud. The analyst needs to determine the most effective source to gather information about threat actors specifically targeting cloud service providers and their attack techniques. Which of the following sources should the analyst prioritize?

Question 33easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI manager is reviewing the team's Priority Intelligence Requirements (PIRs) and notices that they are too broad, making it difficult to focus collection efforts. Which action should the manager take to improve the PIRs?

Question 34hardmulti select

Read the full Requirements Planning Direction And Review explanation →

A CTI manager is reviewing the intelligence requirements after a major business acquisition expanded the organization's presence into new regions. The manager must adjust the requirements to address new risks. Which TWO of the following actions are most appropriate during this review? (Choose two.)

Question 35easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI team is developing its intelligence requirements for the upcoming year. The team lead wants to ensure that the requirements are structured to support both tactical and strategic decision-making. Which of the following best describes the primary purpose of defining Priority Intelligence Requirements (PIRs)?

Question 36hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI manager is conducting a review of the intelligence requirements after a major merger. The organization's priorities have shifted, and the manager must ensure that the collection efforts remain aligned with the new business objectives. Which of the following actions best ensures that the intelligence requirements continue to meet the evolving needs?

Question 37hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is tasked with developing a collection plan to support the organization's intelligence requirements. The analyst must prioritize sources based on reliability, relevance, and cost. Which of the following criteria should be the PRIMARY consideration when selecting sources?

Question 38easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is developing a collection plan to support a new intelligence requirement on ransomware targeting the healthcare sector. The analyst needs to identify the most appropriate type of collection to gather information on ransomware variants and their tactics. Which of the following collection sources is best suited for this requirement?

Question 39mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is tasked with reviewing the effectiveness of the intelligence program. The analyst notices that despite having clear PIRs, the intelligence reports often fail to answer the specific questions posed by decision-makers. Which of the following should the analyst evaluate FIRST to identify the root cause?

Question 40easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

During the direction phase of the intelligence cycle, a CTI analyst receives a request from the Chief Information Security Officer (CISO) for intelligence on a specific threat actor group that has been targeting the organization's industry. The analyst must translate this request into a formal intelligence requirement. Which of the following is the most appropriate first step?

Question 41mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is tasked with producing a threat assessment for the upcoming quarter. The analyst must decide which intelligence requirements to prioritize based on the organization's risk appetite and current threat landscape. Which of the following criteria is most important when prioritizing requirements?

Question 42mediummulti select

Read the full Requirements Planning Direction And Review explanation →

A CTI team is conducting a requirements review with stakeholders to ensure the intelligence program remains aligned with business objectives. Which TWO activities are essential during this review? (Choose two.)

Question 43hardmulti select

Read the full Requirements Planning Direction And Review explanation →

A CTI manager is conducting a formal review of the intelligence program to ensure it remains aligned with business goals. The review will assess the effectiveness of the requirements planning, direction, and review phases. Which TWO activities are essential components of the review phase in the intelligence cycle? (Choose two.)

Question 44mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI team is developing a collection plan for a new intelligence requirement focused on ransomware groups targeting the healthcare sector. The team must select the most relevant sources to gather information on these groups' tactics, techniques, and procedures (TTPs). Which of the following sources would provide the most direct and actionable intelligence for this requirement?

Question 45hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is conducting a review of the intelligence requirements after a series of false positives from automated collection tools. The review aims to refine the requirements to reduce noise. Which of the following actions best addresses this issue?

Question 46mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is developing a set of Specific Intelligence Requirements (SIRs) to support the organization's PIRs. The analyst must ensure that each SIR is measurable and time-bound. Which of the following is the BEST example of a well-formulated SIR?

Question 47hardmulti select

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is tasked with creating a collection plan for a new intelligence requirement focused on advanced persistent threat (APT) actors targeting the organization's cloud infrastructure. The analyst must consider various factors to ensure the plan is effective. Which TWO of the following are essential components of an effective collection plan for this requirement? (Choose two.)

Question 48mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A newly appointed CTI lead at a financial services firm is asked to align the intelligence program with the business’s strategic risk appetite. The executive team wants to know how CTI will support decisions about mergers and acquisitions. Which of the following best describes the primary purpose of defining Priority Intelligence Requirements (PIRs) in this context?

Question 49hardmultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI manager is conducting a requirements review with stakeholders from legal, IT, and business units. During the meeting, the legal team requests intelligence on data breach notification laws in all 50 U.S. states. The CTI team currently has no collection sources for legal research. Which action should the CTI manager take FIRST to address this request?

Question 50easymultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI analyst is drafting intelligence requirements for a new program. The analyst wants to ensure that each requirement is actionable and can be used to guide collection. Which of the following is the most important characteristic of a well-written intelligence requirement?

Question 51mediummultiple choice

Read the full Requirements Planning Direction And Review explanation →

A CTI team is conducting a periodic review of its intelligence requirements. The team notices that several requirements have not generated any collection or analysis in the past six months. Which of the following is the MOST appropriate action for the team to take?

Question 52mediummulti select

Read the full Requirements Planning Direction And Review explanation →

A CTI manager is developing a collection plan to support a new intelligence requirement on supply chain attacks targeting the organization’s software vendors. The manager needs to identify the types of intelligence sources that should be included. Which THREE of the following are appropriate sources for this collection plan? (Choose three.)