312-85 Requirements Planning Direction And Review — Timed 10 Questions

Question 1

During program planning for a threat intelligence capability, the security team maps their intelligence processes to the NIST Cybersecurity Framework (CSF). Which CSF function is most directly aligned with establishing Threat Intelligence requirements, gathering sources, and reviewing intelligence collection efficacy?

10 minute time limit — choose an answer to begin.

Accepted Answer

Identify (ID). The NIST CSF 'Govern' (GV) and 'Identify' (ID) functions encompass the establishment of policies, procedures, and asset/threat identification, with ID.RA (Risk Assessment) and GV subcategories guiding intelligence requirement definition.

Answer

Recover (RC)

Answer

Respond (RS)

Answer

Protect (PR)

Question 2

When structuring a Threat Intelligence program, a CTI leader must establish structured analytic techniques to overcome cognitive biases during analysis. Which THREE are recognized structured analytic techniques used in intelligence analysis? (Choose THREE)

Accepted Answer

Devil's Advocacy. Analysis of Competing Hypotheses (ACH), Red Hat Analysis, and Devil's Advocacy are standard structured analytic techniques.

Answer

Symmetric Key Cryptographic Padding

Answer

Randomized MAC Address Rotation

Question 3

A financial services CTI team has completed its first year and the intelligence manager must now establish a formal Intelligence Requirements Review Board (IRRB) to continuously govern requirements. She wants the board to perform the core review functions that keep requirements relevant and prioritized. Which THREE activities should the IRRB perform on a recurring basis? (Choose three.)

Accepted Answer

Reassess whether each existing requirement still maps to a current business or security objective and retire requirements whose consumers no longer need them. An Intelligence Requirements Review Board exists to keep requirements alive and aligned, so it periodically re-validates that each requirement still supports a current business objective, re-ranks requirements when threat or business conditions change, and collects and analyzes reporting against approved requirements to test whether they are being satisfied. Detection rule tuning and budget approval are operational or executive functions outside the board's requirements-governance scope.

Answer

Approve the annual cybersecurity budget and sign off on vendor contract renewals for the security organization

Answer

Configure firewall and EDR detection rules so that indicators produced by the team are enforced on perimeter and endpoint controls

Question 4

During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?

Accepted Answer

To define specific information needs that support organizational decision-making and risk reduction. Priority Intelligence Requirements (PIRs) are the specific, decision-relevant intelligence questions that drive collection and analysis. Defining them during Requirements Planning ensures the CTI program produces intelligence that supports organizational decision-making and risk reduction, rather than unfocused data gathering.

Answer

To schedule routine penetration testing intervals across the enterprise network

Answer

To outline the budget allocation for commercial threat feed subscriptions

Answer

To establish automated firewall blocklists for known malicious IP addresses

Question 5

A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?

Accepted Answer

Capability. In the Diamond Model, the four core vertices are Adversary, Capability, Infrastructure, and Victim. Capability represents the tools and techniques (TTPs) used by the adversary.

Answer

Infrastructure

Answer

Adversary

Answer

Victim

Question 6

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

Accepted Answer

Triage, validate, and prioritize the RFI against established intelligence priorities. In the direction phase of the intelligence lifecycle, RFIs submitted by operational teams must go through a structured management process. The correct next step is to triage the RFI (assess its urgency and scope), validate it (confirm it aligns with collection capabilities and is a legitimate intelligence requirement), and prioritize it against established Priority Intelligence Requirements (PIRs). This ensures collection and analysis resources are directed toward the most mission-critical questions rather than ad-hoc operational noise.

Answer

Immediately publish the raw telemetry to the corporate intranet without validation

Answer

Archive the RFI immediately as operational queries fall outside the scope of CTI

Answer

Initiate an immediate red-team attack campaign against the external supplier

Question 7

An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?

Accepted Answer

Strategic Threat Intelligence Analyst. The Threat Intelligence Manager or Strategic Threat Analyst bridges the gap between technical threat indicators and business risk, ensuring executive leadership understands the strategic impact.

Answer

Vulnerability Assessor

Answer

Malware Reverse Engineer

Answer

Incident Responder

Question 8

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

Accepted Answer

Standardization of intelligence processes and a unified view of organizational risk. A centralized team allows for better standardization of intelligence processes, resource pooling, and a unified view of the enterprise threat landscape.

Answer

Elimination of the need for external commercial threat feeds

Answer

Complete elimination of communication silos with local IT helpdesks

Answer

Faster deployment of endpoint agents on localized operational technology networks

Question 9

An organization is updating its threat landscape analysis methodology to better account for sector-specific threats. Which stakeholder group should the CTI team primarily consult to gather accurate sector-specific threat requirements?

Accepted Answer

Industry-specific ISACs and regulatory compliance bodies. Industry-specific Information Sharing and Analysis Centers (ISACs) and regulatory compliance bodies are the authoritative sources for sector-specific threat intelligence, providing curated threat feeds, indicators, and best practices tailored to industries like finance (FS-ISAC), healthcare (H-ISAC), and energy (E-ISAC). They also align intelligence requirements with regulatory obligations, ensuring the CTI team's methodology reflects both threat reality and compliance mandates.

Answer

Social media marketing agencies

Answer

Commercial real estate brokers

Answer

Consumer product retail vendors

Question 10

A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?

Accepted Answer

Percentage of intelligence reports that result in actionable security controls or detection rules. Measuring actionable outcomes, such as the percentage of intelligence reports that lead to confirmed threat mitigation or detection rule creation, evaluates quality and relevance.

Answer

Number of threat intelligence blog posts published on the corporate website

Answer

Total gigabytes of threat data ingested from commercial feeds per month

Answer

Total number of security alerts generated by the SIEM