312-85 Requirements Planning Direction And Review Practice Test 3 — 15 Questions

Question 1

A CTI analyst is conducting the direction phase for a new intelligence requirement focused on a persistent threat group targeting the organization's financial systems. The analyst must define the Essential Elements of Information (EEI) to guide collection. Which of the following best describes the purpose of EEIs in this context?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

They outline the critical information gaps that must be filled to satisfy the intelligence requirement.. EEIs are the specific information requirements that must be satisfied to answer a broader intelligence requirement. They help analysts focus collection and analysis on the most critical unknowns. In this case, identifying the gaps about the threat group's methods and targets ensures that the intelligence produced is relevant and actionable for protecting financial systems.

Answer

They provide a prioritized list of intelligence consumers and their respective information needs.

Answer

They establish the timeline and milestones for delivering intelligence products to stakeholders.

Answer

They specify the exact data fields and sources required to answer the intelligence requirement.

Question 2

A threat intelligence analyst is assigned to establish a collection plan for a new business unit that has just expanded its operations to the cloud. The analyst needs to determine the most effective source to gather information about threat actors specifically targeting cloud service providers and their attack techniques. Which of the following sources should the analyst prioritize?

Accepted Answer

Commercial threat intelligence feeds that specialize in cloud threat actors and their TTPs.. The collection plan requires sources that directly address the specific threat landscape of cloud service providers. Commercial threat intelligence feeds specializing in cloud threats offer the necessary depth, including actor profiles and TTPs, which are critical for understanding how adversaries operate in cloud environments. These feeds are tailored to meet operational intelligence requirements and provide actionable data for defense.

Answer

Government alerts and advisories from national cybersecurity agencies.

Answer

Internal incident reports from the organization's own security operations center (SOC).

Answer

Open-source intelligence (OSINT) feeds from general cybersecurity news websites.

Question 3

A CTI manager is reviewing the team's Priority Intelligence Requirements (PIRs) and notices that they are too broad, making it difficult to focus collection efforts. Which action should the manager take to improve the PIRs?

Accepted Answer

Narrow the scope by specifying the threat actors, tactics, and assets of concern.. The correct action is to narrow the scope by specifying threat actors, tactics, and assets of concern. This makes PIRs more specific and actionable, enabling the CTI team to prioritize collection and analysis effectively. Broad PIRs waste resources and produce intelligence that may not support decision-making. By focusing on the most relevant threats and assets, the manager ensures the PIRs are aligned with organizational risk.

Answer

Replace PIRs with a list of all known vulnerabilities in the environment.

Answer

Increase the number of PIRs to cover more potential threats.

Answer

Delegate the PIR definition to the IT operations team.

Question 4

A CTI manager is reviewing the intelligence requirements after a major business acquisition expanded the organization's presence into new regions. The manager must adjust the requirements to address new risks. Which TWO of the following actions are most appropriate during this review? (Choose two.)

Accepted Answer

Reassess the Priority Intelligence Requirements (PIRs) to reflect the new geopolitical and regulatory landscape.. The acquisition expands the organization's risk profile, so the CTI manager must update PIRs to reflect new geopolitical and regulatory factors and engage with new stakeholders to capture their intelligence needs. These actions ensure the requirements remain aligned with business goals and that intelligence supports decision-making across the expanded enterprise.

Answer

Immediately task collection assets to gather intelligence on all threat actors active in the new regions without updating requirements.

Answer

Reduce the scope of intelligence collection to only the original business units until the acquisition is fully integrated.

Answer

Maintain the existing intelligence requirements to avoid disrupting ongoing collection and analysis efforts.

Question 5

A CTI team is developing its intelligence requirements for the upcoming year. The team lead wants to ensure that the requirements are structured to support both tactical and strategic decision-making. Which of the following best describes the primary purpose of defining Priority Intelligence Requirements (PIRs)?

Accepted Answer

To guide the collection and analysis of intelligence that supports specific decisions. PIRs are the mechanism to translate decision-maker needs into focused intelligence questions. They prioritize collection and analysis so that resources are used efficiently and outputs are relevant. By defining PIRs, a CTI team ensures that both tactical and strategic decisions are supported with timely and actionable intelligence, rather than being overwhelmed by irrelevant data.

Answer

To provide a comprehensive list of all potential threats to the organization

Answer

To establish the technical specifications for threat intelligence platform integration

Answer

To catalog all available threat data sources for future reference

Question 6

A CTI manager is conducting a review of the intelligence requirements after a major merger. The organization's priorities have shifted, and the manager must ensure that the collection efforts remain aligned with the new business objectives. Which of the following actions best ensures that the intelligence requirements continue to meet the evolving needs?

Accepted Answer

Reassess the Priority Intelligence Requirements (PIRs) with stakeholders from both merging entities.. The merger introduces new business objectives and risks, so the intelligence requirements must be revisited collaboratively. Reassessing PIRs with stakeholders from both entities ensures that the requirements capture the combined priorities and that collection efforts are directed toward what matters most. This approach aligns intelligence with decision-making needs and prevents wasted resources on irrelevant data.

Answer

Implement a new threat intelligence platform (TIP) to centralize all data.

Answer

Increase the frequency of automated threat feed ingestion to capture more data.

Answer

Delegate the review to the SOC manager to update tactical detection rules.

Question 7

A CTI analyst is tasked with developing a collection plan to support the organization's intelligence requirements. The analyst must prioritize sources based on reliability, relevance, and cost. Which of the following criteria should be the PRIMARY consideration when selecting sources?

Accepted Answer

The source's ability to provide timely and actionable information that directly addresses the intelligence requirements.. The primary consideration should be the source's ability to provide timely and actionable information that directly addresses the intelligence requirements. This ensures that collection efforts are driven by decision-maker needs rather than convenience or cost alone. While cost, popularity, and integration are factors, they are secondary to the fundamental purpose of intelligence: supporting timely and informed decisions.

Answer

The source's popularity and widespread use in the industry.

Answer

The source's cost, ensuring it fits within the allocated budget.

Answer

The source's technical format and ease of integration with existing tools.

Question 8

A CTI analyst is developing a collection plan to support a new intelligence requirement on ransomware targeting the healthcare sector. The analyst needs to identify the most appropriate type of collection to gather information on ransomware variants and their tactics. Which of the following collection sources is best suited for this requirement?

Accepted Answer

Open-source intelligence (OSINT) from healthcare industry reports and ransomware tracking blogs.. OSINT is the most suitable collection source because it leverages publicly available reports and analyses from healthcare organizations and security researchers, providing timely and relevant information on ransomware variants and tactics. It is accessible, cost-effective, and directly addresses the requirement without the risks or limitations of other intelligence disciplines.

Answer

Human intelligence (HUMINT) from undercover agents within ransomware groups.

Answer

Imagery intelligence (IMINT) from satellite reconnaissance of ransomware infrastructure.

Answer

Signals intelligence (SIGINT) from intercepted communications of ransomware operators.

Question 9

A CTI analyst is tasked with reviewing the effectiveness of the intelligence program. The analyst notices that despite having clear PIRs, the intelligence reports often fail to answer the specific questions posed by decision-makers. Which of the following should the analyst evaluate FIRST to identify the root cause?

Accepted Answer

The alignment between PIRs and the collection plan. The root cause of reports failing to answer PIRs is often a disconnect between the requirements and the collection plan. The collection plan operationalizes PIRs by specifying what data to collect, from where, and how. If it is not aligned, intelligence production will miss the mark. Therefore, evaluating this alignment is the logical first step before considering technology or distribution factors.

Answer

The frequency of intelligence report distribution

Answer

The technical capabilities of the threat intelligence platform

Answer

The number of intelligence sources available

Question 10

During the direction phase of the intelligence cycle, a CTI analyst receives a request from the Chief Information Security Officer (CISO) for intelligence on a specific threat actor group that has been targeting the organization's industry. The analyst must translate this request into a formal intelligence requirement. Which of the following is the most appropriate first step?

Accepted Answer

Clarify the CISO's specific intelligence needs, including the desired format and timeline.. The direction phase emphasizes understanding the consumer's intelligence needs. By clarifying the CISO's specific requirements—such as the focus of the intelligence, the desired format, and the deadline—the analyst can create a precise intelligence requirement that guides efficient collection and analysis. This step prevents misalignment and ensures the final product meets the consumer's expectations.

Answer

Immediately begin collecting data from all available sources about the threat actor.

Answer

Draft a comprehensive report on the threat actor using existing internal data.

Answer

Escalate the request to the incident response team for immediate action.

Question 11

A CTI analyst is tasked with producing a threat assessment for the upcoming quarter. The analyst must decide which intelligence requirements to prioritize based on the organization's risk appetite and current threat landscape. Which of the following criteria is most important when prioritizing requirements?

Accepted Answer

The potential impact on the organization's critical assets and business operations.. The most important criterion is the potential impact on critical assets and business operations, as this directly relates to organizational risk. Prioritizing requirements this way ensures that the CTI program addresses the most significant threats first, aligning with the risk appetite and supporting informed decision-making.

Answer

The personal interest of the CTI team members in specific threat actors.

Answer

The availability of open-source information on the threat.

Answer

The ease of collection and analysis for each requirement.

Question 12

A CTI team is conducting a requirements review with stakeholders to ensure the intelligence program remains aligned with business objectives. Which TWO activities are essential during this review? (Choose two.)

Accepted Answer

Assessing whether current intelligence products are meeting stakeholder needs.. The essential activities are assessing whether current intelligence products meet stakeholder needs and updating requirements based on changes in the threat landscape and business priorities. These activities ensure the program remains aligned with business objectives, delivers value, and adapts to evolving risks. They also foster stakeholder engagement and continuous improvement, which are critical for a successful CTI program.

Answer

Conducting a penetration test to identify vulnerabilities.

Answer

Replacing all existing intelligence requirements with new ones from scratch.

Answer

Increasing the number of intelligence feeds to cover more sources.

Question 13

A CTI manager is conducting a formal review of the intelligence program to ensure it remains aligned with business goals. The review will assess the effectiveness of the requirements planning, direction, and review phases. Which TWO activities are essential components of the review phase in the intelligence cycle? (Choose two.)

Accepted Answer

Evaluating the relevance of existing PIRs to current business objectives. The review phase is about evaluating the intelligence program's effectiveness and alignment with business goals. Assessing the relevance of PIRs ensures requirements stay current, while measuring the impact of intelligence products determines whether they support decision-making. These activities drive continuous improvement and are distinct from planning, collection, or dissemination.

Answer

Collecting data from newly identified sources to fill intelligence gaps

Answer

Disseminating intelligence reports to stakeholders

Answer

Drafting new intelligence requirements based on emerging threats

Question 14

A CTI team is developing a collection plan for a new intelligence requirement focused on ransomware groups targeting the healthcare sector. The team must select the most relevant sources to gather information on these groups' tactics, techniques, and procedures (TTPs). Which of the following sources would provide the most direct and actionable intelligence for this requirement?

Accepted Answer

Dark web forums and marketplaces where ransomware groups communicate and advertise.. Dark web forums and marketplaces are where ransomware groups plan and coordinate, making them a direct source for intelligence on their TTPs. Monitoring these hidden channels can yield actionable information such as new ransomware variants, exploit techniques, and targeting preferences. This source aligns closely with the requirement to understand ransomware groups targeting healthcare, enabling proactive defense.

Answer

Industry reports from healthcare associations on cybersecurity best practices.

Answer

Vulnerability databases such as the National Vulnerability Database (NVD).

Answer

Social media platforms like Twitter and LinkedIn for general cybersecurity discussions.

Question 15

A CTI analyst is conducting a review of the intelligence requirements after a series of false positives from automated collection tools. The review aims to refine the requirements to reduce noise. Which of the following actions best addresses this issue?

Accepted Answer

Increase the specificity of the Essential Elements of Information (EEIs) to focus collection on precise indicators.. Increasing the specificity of EEIs directly addresses false positives by making collection criteria more precise, ensuring that only relevant information is gathered. This refinement helps align collection with the actual intelligence needs, reducing noise and improving the signal-to-noise ratio without sacrificing coverage of critical threats.

Answer

Broaden the scope of the intelligence requirements to capture more data for analysis.

Answer

Reduce the number of intelligence requirements to only those that are easiest to collect.

Answer

Disable automated collection tools and rely solely on manual analysis.