312-85 Requirements Planning Direction And Review Practice Test 2 — 15 Questions

Question 1

An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Information on exploit frameworks, payload construction tools, and customized delivery mechanisms used by target threat groups. Weaponization involves coupling an exploit with a payload (e.g., a PDF or Office document). Collecting intelligence on weaponization involves gathering data on exploit kits, payload templates, and builder tools used by adversaries.

Answer

Phishing email headers received by internal mail servers from external domains

Answer

File hashes and indicators associated with credential dumping tools like Mimikatz

Answer

Network traffic logs showing data exfiltration over encrypted channels

Question 2

An organization is establishing metrics for its Threat Intelligence program review. The CTI director wants to measure 'Collection Efficiency.' Which formula or evaluation method best represents this metric?

Accepted Answer

The ratio of high-value intelligence reports produced that directly answered PIRs versus total raw data collected. Collection Efficiency measures how well the collection process converts raw data into intelligence that answers Priority Intelligence Requirements (PIRs). The ratio of high-value reports that directly answered PIRs to total raw data collected captures this conversion rate — a high ratio means the collection sources are well-targeted and not producing excessive noise. This is the standard CTI metric for evaluating whether collection resources are being used effectively.

Answer

The number of firewall rule changes approved by change management

Answer

The total financial cost of commercial intelligence subscriptions divided by the number of employees

Answer

The average time it takes an analyst to write a quarterly report

Question 3

A CTI program is conducting a formal review of its intelligence requirements to ensure alignment with changing business goals. Which phase of the intelligence cycle directly feeds into the direction and planning phase during this review?

Accepted Answer

Dissemination and Feedback. The intelligence cycle is a closed loop: Direction/Planning sets requirements, Collection gathers raw data, Processing turns it into usable form, Analysis produces intelligence, and Dissemination delivers it to consumers. The Feedback component of Dissemination is what tells planners whether the intelligence answered the original requirements, so it directly feeds back into the next Direction and Planning cycle. During a formal requirements review, this feedback loop is the mechanism that realigns intelligence requirements with evolving business goals.

Answer

Processing and Exploitation

Answer

Automated Malware Sandboxing

Answer

Tactical Log Ingestion

Question 4

During the requirements planning phase, a CTI analyst categorizes intelligence needs based on consumer levels. Which THREE types of intelligence consumers must be addressed in a comprehensive intelligence plan? (Choose THREE)

Accepted Answer

Tactical level (SIEM systems, Automated security controls, SOC analysts). The three correct answers are A, B, and D because a comprehensive intelligence plan must serve all three recognized consumer tiers. Option A, the tactical level (SIEM systems, automated security controls, SOC analysts), is correct because these consumers need immediate, machine-readable and indicator-level intelligence to drive detection, blocking, and alerting in real time. Option B, the strategic level (executive leadership, Board of Directors), is correct because these consumers require high-level, long-term intelligence about risks, trends, and business impact to inform governance, budgeting, and risk decisions. Option D, the operational level (SOC managers, incident responders), is correct because these consumers need campaign-level, contextual intelligence to prioritize investigations, allocate resources, and coordinate response activities. Option C is incorrect because corporate real estate leasing committees are not a standard intelligence consumer category and have no defined role in threat intelligence requirements. Option E is incorrect because external product marketing teams fall outside the organization's security intelligence consumer model and are not part of a CTI plan's defined audience.

Answer

Corporate real estate leasing committees

Answer

External consumer product marketing teams

Question 5

An intelligence manager is evaluating sources for a threat intelligence program during the planning phase. Which TWO criteria are critical when vetting a new external threat intelligence vendor or feed? (Choose TWO)

Accepted Answer

Relevance of the feed data to the organization's specific industry sector and geographic footprint. Option A is correct because a threat intelligence feed must be relevant to the organization's specific industry sector and geographic footprint; intelligence about threats targeting unrelated sectors or regions wastes resources and fails to inform risk-based decisions. Option D is correct because actionability is a core vetting criterion: the intelligence must be timely, contextual, and specific enough to drive concrete updates to security controls such as firewall rules, IDS/IPS signatures, or SIEM detections. Option B is incorrect because a vendor's marketing budget has no bearing on the technical quality, accuracy, or usefulness of its intelligence. Option C is incorrect because publicly sharing all threat data on open-source social media does not indicate vendor quality and may actually reduce the exclusivity and value of the feed. Option E is incorrect because raw volume of unverified IP addresses without regard to false positive rates is a poor metric; high false positives degrade detection fidelity and increase analyst workload.

Answer

The marketing budget of the threat intelligence vendor

Answer

Whether the vendor shares all threat data publicly on open-source social media platforms

Answer

The total number of unverified IP addresses included in the feed without regard to false positive rates

Question 6

When establishing a Threat Intelligence program, a manager must outline the core functions of the TI team. Which TWO of the following responsibilities typically fall under a dedicated CTI team's scope? (Choose TWO)

Accepted Answer

Analyzing threat actor campaigns, motivations, and Tactics, Techniques, and Procedures (TTPs). Option C is correct because a core function of a dedicated Cyber Threat Intelligence (CTI) team is analyzing threat actor campaigns, motivations, and TTPs, typically mapped to frameworks like MITRE ATT&CK, to understand adversary behavior and inform defenses. Option D is correct because CTI teams produce finished intelligence reports and briefings tailored to operational and strategic stakeholders, translating raw data into actionable intelligence for decision-makers at different levels. Options A, B, and E do not belong: physical security audits of parking garages fall under corporate/physical security, writing custom business logic for customer-facing web applications is a software development responsibility, and directly configuring firewall ACLs and routing tables is a network/security engineering operational task, not a CTI analytical function.

Answer

Performing physical security audits of corporate parking garages

Answer

Writing and deploying custom business logic for customer-facing web applications

Answer

Directly configuring enterprise firewall access control lists and routing tables

Question 7

During the threat landscape analysis and requirements gathering process, an organization must identify its critical assets and crown jewels. Which THREE categories represent typical critical assets that should drive intelligence requirements? (Choose THREE)

Accepted Answer

Core industrial control systems or production manufacturing IT/OT infrastructure. Option A is correct because ICS, SCADA, and OT/production manufacturing infrastructure are crown-jewel assets whose compromise can halt physical operations, cause safety incidents, or enable destructive attacks, so they must directly shape intelligence requirements. Option C is correct because customer PII and financial records are regulated, high-value data (e.g., under GDPR, PCI DSS, HIPAA) whose theft drives breach costs, notification duties, and attacker monetization, making them a primary intelligence priority. Option E is correct because proprietary source code and intellectual property represent competitive advantage and are frequent targets of nation-state and corporate espionage, so collection requirements should focus on actors, TTPs, and exfiltration vectors targeting them. Option B does not belong because publicly available marketing brochures are intentionally disclosed, non-sensitive, and carry no confidentiality or operational impact. Option D does not belong because breakroom snack inventory logs have no security, regulatory, financial, or mission value and would not drive intelligence requirements.

Answer

Publicly available marketing brochures hosted on the corporate website

Answer

Breakroom snack inventory logs

Question 8

An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)

Accepted Answer

Tasking collection assets and monitoring the flow of raw intelligence data. Collection management involves identifying and acquiring sources to answer intelligence requirements while monitoring collection performance.

Answer

Conducting corporate financial payroll audits

Answer

Configuring office building climate control thermostats

Answer

Writing custom assembly code for rootkit deployment

Question 9

During program planning for a CTI team, the program manager must define stakeholder engagement protocols. Which THREE stakeholder groups should be actively engaged during the requirements planning and review phases? (Choose THREE)

Accepted Answer

Executive Leadership and Risk Management (CISO, CRO). Executive Leadership and Risk Management (CISO, CRO) (B) must be engaged because they own the risk appetite, budget authority, and governance decisions that shape CTI requirements and priorities, ensuring the program aligns with organizational risk tolerance and regulatory obligations. SOC managers (C) are essential stakeholders since they are the primary consumers of CTI, and their detection, monitoring, and triage workflows define the intelligence requirements, formats, and timeliness needed for operational use. Incident Response team leads (D) must be involved because IR uses CTI during investigations and containment, so their feedback on indicators, threat context, and reporting cadence directly drives requirements during planning and review. The remaining options do not belong: residential landscaping contractors (A) and external catering service providers (E) have no role in cybersecurity intelligence requirements, governance, or incident handling, making them irrelevant to CTI stakeholder engagement.

Answer

Residential landscaping contractors

Answer

External catering service providers

Question 10

An organization is conducting a review of its threat intelligence program to assess alignment with intelligence-driven defense models. Which TWO frameworks are widely used to structure threat intelligence planning, collection, and defense operations? (Choose TWO)

Accepted Answer

Lockheed Martin Cyber Kill Chain. The Lockheed Martin Cyber Kill Chain (A) is correct because it is a widely adopted intelligence-driven defense model that structures threat intelligence planning and collection by breaking an intrusion into seven sequential phases—Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives—allowing defenders to map intelligence to each stage and disrupt attacks. The MITRE ATT&CK Framework (E) is also correct because it catalogs real-world adversary tactics, techniques, and procedures (TTPs) across the enterprise, mobile, and ICS matrices, providing a common taxonomy that organizations use to structure threat intelligence collection, prioritize defenses, and align detection engineering with observed adversary behavior. The remaining options do not belong: SMTP (B) and HTTPS RFC standards (C) are communication protocol specifications, not threat intelligence or defense-operation frameworks, and BIOS/UEFI firmware specifications (D) define platform boot firmware interfaces, which are unrelated to structuring threat intelligence planning, collection, or defense operations.

Answer

Simple Mail Transfer Protocol (SMTP) specification

Answer

Hypertext Transfer Protocol Secure (HTTPS) RFC standards

Answer

Basic Input/Output System (BIOS) UEFI firmware specifications

Question 11

When planning a Threat Intelligence program budget, an organization must account for various resource categories. Which THREE resource categories should be included in the CTI program budget plan? (Choose THREE)

Accepted Answer

Analyst professional development, training, and industry certifications. Option A is correct because a CTI program depends on skilled analysts, so budgeting for professional development, training, and industry certifications (e.g., GCTI, CTIA) ensures the team can perform collection, analysis, and dissemination effectively. Option C is correct because threat intelligence sharing memberships such as ISACs and ISAOs require fees and resources, and they provide sector-specific indicators, tactical intelligence, and peer collaboration essential to a CTI program. Option E is correct because commercial threat intelligence feed subscriptions and Threat Intelligence Platforms (TIP) are core technical and data resources needed to ingest, normalize, correlate, and operationalize threat data. Option B is incorrect because fleet vehicle insurance for corporate delivery trucks is a logistics/operations expense unrelated to cyber threat intelligence capabilities. Option D is incorrect because commercial cafeteria food and beverage restocking is a facilities expense and has no bearing on CTI program resources.

Answer

Fleet vehicle insurance policies for corporate delivery trucks

Answer

Commercial cafeteria food and beverage restocking contracts

Question 12

A retail company's newly appointed CTI lead is defining the direction phase for the coming year. The Chief Information Security Officer asks her to document how intelligence requirements will be gathered from the business and turned into a prioritized set of questions the team must answer. Which deliverable best represents the output of the direction phase?

Accepted Answer

A prioritized set of intelligence requirements derived from stakeholder decision needs and approved by leadership. Direction is about deciding what the organization needs to know. By interviewing stakeholders and translating their decision needs into an approved, prioritized set of intelligence requirements, the CTI lead produces the artifact that steers collection and analysis. Platform deployment, finished reports, and response contracts are enabling, downstream, or unrelated activities rather than the direction deliverable.

Answer

A finished malware analysis report with indicators of compromise for a recent intrusion

Answer

A signed incident response retainer contract with an external forensic provider

Answer

A completed threat intelligence platform deployment with normalized feeds and dashboards

Question 13

A global manufacturing company is establishing a new CTI program. The CISO wants to ensure that intelligence production remains focused on the organization's most critical business assets and that resources are allocated efficiently. Which of the following should the CTI manager produce FIRST to define the specific intelligence needs that support strategic decision-making?

Accepted Answer

Priority Intelligence Requirements (PIRs). Priority Intelligence Requirements (PIRs) are the cornerstone of the direction phase, translating business objectives into specific intelligence questions. They guide collection and analysis, ensuring resources target what matters most. In this scenario, the CISO's emphasis on critical assets and strategic decision-making makes PIRs the necessary first output to focus the CTI program effectively.

Answer

Stakeholder contact list

Answer

Threat Intelligence Platform (TIP) deployment

Answer

Intelligence Collection Plan

Question 14

A CTI analyst is defining Intelligence Requirements (IRs) for a new threat intelligence program. The CISO asks the analyst to ensure that the IRs are both actionable and aligned with the organization's risk appetite. Which of the following is the MOST appropriate first step in this process?

Accepted Answer

Conduct a stakeholder workshop to identify critical assets and business processes.. The correct answer is to conduct a stakeholder workshop to identify critical assets and business processes. This step ensures that Intelligence Requirements are grounded in the organization's actual risk landscape and business objectives, making them actionable and aligned with the CISO's risk appetite. It also facilitates prioritization and consensus among stakeholders, which is essential for a successful CTI program.

Answer

Review past incident reports to identify all previous attacker techniques.

Answer

Deploy a SIEM and begin collecting all available log sources.

Answer

Subscribe to multiple threat intelligence feeds to gather as much data as possible.

Question 15

A CTI analyst is conducting a review of the intelligence program after six months of operation. The review reveals that several PIRs are no longer relevant due to a recent merger and acquisition. The analyst must realign the intelligence requirements with the new business strategy. Which of the following activities should the analyst perform FIRST to ensure the requirements remain effective?

Accepted Answer

Re-interview key stakeholders to update intelligence needs. Following a merger, business priorities change, so the first step is to re-engage stakeholders to capture new intelligence requirements. This ensures that subsequent activities like collection and analysis are aligned with the updated strategy. Without this step, any adjustments to collection or frameworks may be based on obsolete needs, leading to wasted effort and ineffective intelligence support.

Answer

Revise the collection management framework

Answer

Immediately expand collection sources to cover new assets

Answer

Perform a gap analysis of existing intelligence holdings