312-85 Requirements Planning Direction And Review — Timed 15 Questions

Question 1

During program planning for a threat intelligence capability, the security team maps their intelligence processes to the NIST Cybersecurity Framework (CSF). Which CSF function is most directly aligned with establishing Threat Intelligence requirements, gathering sources, and reviewing intelligence collection efficacy?

15 minute time limit — choose an answer to begin.

Accepted Answer

Identify (ID). The NIST CSF 'Govern' (GV) and 'Identify' (ID) functions encompass the establishment of policies, procedures, and asset/threat identification, with ID.RA (Risk Assessment) and GV subcategories guiding intelligence requirement definition.

Answer

Recover (RC)

Answer

Respond (RS)

Answer

Protect (PR)

Question 2

When structuring a Threat Intelligence program, a CTI leader must establish structured analytic techniques to overcome cognitive biases during analysis. Which THREE are recognized structured analytic techniques used in intelligence analysis? (Choose THREE)

Accepted Answer

Devil's Advocacy. Analysis of Competing Hypotheses (ACH), Red Hat Analysis, and Devil's Advocacy are standard structured analytic techniques.

Answer

Symmetric Key Cryptographic Padding

Answer

Randomized MAC Address Rotation

Question 3

A financial services CTI team has completed its first year and the intelligence manager must now establish a formal Intelligence Requirements Review Board (IRRB) to continuously govern requirements. She wants the board to perform the core review functions that keep requirements relevant and prioritized. Which THREE activities should the IRRB perform on a recurring basis? (Choose three.)

Accepted Answer

Reassess whether each existing requirement still maps to a current business or security objective and retire requirements whose consumers no longer need them. An Intelligence Requirements Review Board exists to keep requirements alive and aligned, so it periodically re-validates that each requirement still supports a current business objective, re-ranks requirements when threat or business conditions change, and collects and analyzes reporting against approved requirements to test whether they are being satisfied. Detection rule tuning and budget approval are operational or executive functions outside the board's requirements-governance scope.

Answer

Approve the annual cybersecurity budget and sign off on vendor contract renewals for the security organization

Answer

Configure firewall and EDR detection rules so that indicators produced by the team are enforced on perimeter and endpoint controls

Question 4

During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?

Accepted Answer

To define specific information needs that support organizational decision-making and risk reduction. Priority Intelligence Requirements (PIRs) are the specific, decision-relevant intelligence questions that drive collection and analysis. Defining them during Requirements Planning ensures the CTI program produces intelligence that supports organizational decision-making and risk reduction, rather than unfocused data gathering.

Answer

To schedule routine penetration testing intervals across the enterprise network

Answer

To outline the budget allocation for commercial threat feed subscriptions

Answer

To establish automated firewall blocklists for known malicious IP addresses

Question 5

A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?

Accepted Answer

Capability. In the Diamond Model, the four core vertices are Adversary, Capability, Infrastructure, and Victim. Capability represents the tools and techniques (TTPs) used by the adversary.

Answer

Infrastructure

Answer

Adversary

Answer

Victim

Question 6

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

Accepted Answer

Triage, validate, and prioritize the RFI against established intelligence priorities. In the direction phase of the intelligence lifecycle, RFIs submitted by operational teams must go through a structured management process. The correct next step is to triage the RFI (assess its urgency and scope), validate it (confirm it aligns with collection capabilities and is a legitimate intelligence requirement), and prioritize it against established Priority Intelligence Requirements (PIRs). This ensures collection and analysis resources are directed toward the most mission-critical questions rather than ad-hoc operational noise.

Answer

Immediately publish the raw telemetry to the corporate intranet without validation

Answer

Archive the RFI immediately as operational queries fall outside the scope of CTI

Answer

Initiate an immediate red-team attack campaign against the external supplier

Question 7

An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?

Accepted Answer

Strategic Threat Intelligence Analyst. The Threat Intelligence Manager or Strategic Threat Analyst bridges the gap between technical threat indicators and business risk, ensuring executive leadership understands the strategic impact.

Answer

Vulnerability Assessor

Answer

Malware Reverse Engineer

Answer

Incident Responder

Question 8

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

Accepted Answer

Standardization of intelligence processes and a unified view of organizational risk. A centralized team allows for better standardization of intelligence processes, resource pooling, and a unified view of the enterprise threat landscape.

Answer

Elimination of the need for external commercial threat feeds

Answer

Complete elimination of communication silos with local IT helpdesks

Answer

Faster deployment of endpoint agents on localized operational technology networks

Question 9

An organization is updating its threat landscape analysis methodology to better account for sector-specific threats. Which stakeholder group should the CTI team primarily consult to gather accurate sector-specific threat requirements?

Accepted Answer

Industry-specific ISACs and regulatory compliance bodies. Industry-specific Information Sharing and Analysis Centers (ISACs) and regulatory compliance bodies are the authoritative sources for sector-specific threat intelligence, providing curated threat feeds, indicators, and best practices tailored to industries like finance (FS-ISAC), healthcare (H-ISAC), and energy (E-ISAC). They also align intelligence requirements with regulatory obligations, ensuring the CTI team's methodology reflects both threat reality and compliance mandates.

Answer

Social media marketing agencies

Answer

Commercial real estate brokers

Answer

Consumer product retail vendors

Question 10

A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?

Accepted Answer

Percentage of intelligence reports that result in actionable security controls or detection rules. Measuring actionable outcomes, such as the percentage of intelligence reports that lead to confirmed threat mitigation or detection rule creation, evaluates quality and relevance.

Answer

Number of threat intelligence blog posts published on the corporate website

Answer

Total gigabytes of threat data ingested from commercial feeds per month

Answer

Total number of security alerts generated by the SIEM

Question 11

An intelligence analyst is tasked with tailoring intelligence requirements for a merger and acquisition (M&A) scenario. Which methodology should be applied during the direction phase to identify threat actors specifically interested in compromising corporate transactions?

Accepted Answer

Target-Centric Intelligence Analysis. Target-centric intelligence analysis focuses specifically on the assets, events, or transactions of interest (such as an M&A deal) and maps out all threat actors known to target those specific equities.

Answer

Network Forensic Packet Capture Analysis

Answer

Signature-Based Intrusion Detection Analysis

Answer

Vulnerability Scoring via CVSS v3.1 Base Metrics

Question 12

During the planning phase of building a CTI team, the program manager needs to define the scope of intelligence operations. Which category of intelligence focuses specifically on technical indicators such as file hashes, IP addresses, and domain names?

Accepted Answer

Tactical Intelligence. Tactical intelligence focuses on immediate, actionable technical indicators — file hashes, IP addresses, domain names, and URLs — that defenders use to detect and block threats in the short term. It is the layer of CTI that feeds SIEM rules, IDS signatures, and blocklists, and it is what most SOC analysts consume daily.

Answer

Financial Intelligence

Answer

Operational Intelligence

Answer

Strategic Intelligence

Question 13

A newly formed CTI team is conducting stakeholder interviews to establish intelligence requirements. The Chief Risk Officer (CRO) expresses concern over ransomware supply chain disruptions. How should the intelligence analyst translate this concern into a formal intelligence requirement?

Accepted Answer

Develop requirements to identify ransomware campaigns, threat actor TTPs, and third-party vendors targeting our critical supply chain ecosystem. Translating executive concerns into formal requirements involves formulating specific, answerable questions regarding supply chain vulnerabilities and active ransomware campaigns targeting third-party vendors.

Answer

Collect all CVEs published daily by the National Vulnerability Database (NVD)

Answer

Deploy endpoint detection and response (EDR) agents to all contractor laptops

Answer

Execute regular phishing simulations for all internal business unit employees

Question 14

An intelligence manager is reviewing the threat intelligence program's intelligence gap analysis. The analysis reveals that the team frequently fails to detect supply chain intrusions until late in the attack lifecycle. Which adjustments to the direction and planning phase should the manager implement?

Accepted Answer

Shift intelligence requirements to focus on initial access vectors, third-party supplier dependencies, and forums frequented by Initial Access Brokers (IABs). Refining collection requirements and pivoting focus toward upstream threat indicators (such as supplier dependencies, third-party vendor risks, and initial access brokers) addresses late detection of supply chain intrusions.

Answer

Disable all external threat intelligence feeds to reduce noise in the security operations center

Answer

Reassign all malware reverse engineering tasks to helpdesk support personnel

Answer

Increase the budget for automated SIEM log retention from 30 days to 90 days

Question 15

During the CTI team building process, the manager needs to hire personnel with analytical mindsets who can avoid cognitive biases. Which cognitive bias involves favoring information that confirms pre-existing beliefs while discarding contradictory evidence?

Accepted Answer

Confirmation Bias. Confirmation bias is the tendency to search for, interpret, favor, and recall information in a way that confirms or supports one's prior beliefs or values.

Answer

Availability Heuristic

Answer

Mirror Imaging

Answer

Bandwagon Effect