Requirements Planning Direction And Review

An intelligence analyst is drafting the Request for Information (RFI) workflow during the direction phase. An operational team submits an RFI regarding a newly observed malware strain. What is the correct next step in the RFI management lifecycle?

A CTI program is conducting a formal review of its intelligence requirements to ensure alignment with changing business goals. Which phase of the intelligence cycle directly feeds into the direction and planning phase during this review?

An organization is updating its threat landscape analysis methodology to better account for sector-specific threats. Which stakeholder group should the CTI team primarily consult to gather accurate sector-specific threat requirements?

An organization is structuring a new Threat Intelligence (TI) team and needs to ensure that strategic intelligence reaches executive leadership effectively. Which team role is primarily responsible for translating high-level threat trends into business risk assessments for board members?

When establishing a Threat Intelligence program, a manager must outline the core functions of the TI team. Which TWO of the following responsibilities typically fall under a dedicated CTI team's scope? (Choose TWO)

During the requirements planning phase, a CTI analyst categorizes intelligence needs based on consumer levels. Which THREE types of intelligence consumers must be addressed in a comprehensive intelligence plan? (Choose THREE)

During the Requirements Planning phase of the intelligence cycle, a CTI analyst uses the Priority Intelligence Requirements (PIR) framework. What is the primary purpose of defining PIRs at this stage?

When planning a Threat Intelligence program budget, an organization must account for various resource categories. Which THREE resource categories should be included in the CTI program budget plan? (Choose THREE)

An organization is establishing metrics for its Threat Intelligence program review. The CTI director wants to measure 'Collection Efficiency.' Which formula or evaluation method best represents this metric?

An intelligence manager is reviewing the threat intelligence program's intelligence gap analysis. The analysis reveals that the team frequently fails to detect supply chain intrusions until late in the attack lifecycle. Which adjustments to the direction and planning phase should the manager implement?

An intelligence manager is evaluating sources for a threat intelligence program during the planning phase. Which TWO criteria are critical when vetting a new external threat intelligence vendor or feed? (Choose TWO)

An organization is conducting a review of its threat intelligence program to assess alignment with intelligence-driven defense models. Which TWO frameworks are widely used to structure threat intelligence planning, collection, and defense operations? (Choose TWO)

An intelligence analyst is tasked with tailoring intelligence requirements for a merger and acquisition (M&A) scenario. Which methodology should be applied during the direction phase to identify threat actors specifically interested in compromising corporate transactions?

When building a Threat Intelligence team, the Chief Information Security Officer (CISO) must decide between centralizing the TI function or distributing analysts across various business units. What is a primary advantage of a centralized TI team structure?

During the threat landscape analysis and requirements gathering process, an organization must identify its critical assets and crown jewels. Which THREE categories represent typical critical assets that should drive intelligence requirements? (Choose THREE)

A newly formed CTI team is conducting stakeholder interviews to establish intelligence requirements. The Chief Risk Officer (CRO) expresses concern over ransomware supply chain disruptions. How should the intelligence analyst translate this concern into a formal intelligence requirement?

During the planning phase of building a CTI team, the program manager needs to define the scope of intelligence operations. Which category of intelligence focuses specifically on technical indicators such as file hashes, IP addresses, and domain names?

During program planning for a CTI team, the program manager must define stakeholder engagement protocols. Which THREE stakeholder groups should be actively engaged during the requirements planning and review phases? (Choose THREE)

A CTI program manager is defining Key Performance Indicators (KPIs) to measure the effectiveness of the intelligence program during the review phase. Which metric best measures the quality and relevance of the intelligence produced?

An intelligence analyst is performing a threat landscape analysis using the Cyber Kill Chain framework. During the planning phase, the analyst wants to map collection requirements to disrupt adversaries during the 'Weaponization' phase. What specific intelligence should the analyst plan to collect?

An intelligence analyst is drafting the collection management framework during the planning phase. Which TWO activities are key components of collection management? (Choose TWO)

During program planning for a threat intelligence capability, the security team maps their intelligence processes to the NIST Cybersecurity Framework (CSF). Which CSF function is most directly aligned with establishing Threat Intelligence requirements, gathering sources, and reviewing intelligence collection efficacy?

A CTI team is conducting a threat landscape analysis for a global financial institution. The analyst wants to apply the Diamond Model of Intrusion Analysis during the requirements planning phase to scope out potential adversary capabilities and infrastructure requirements. Which vertex of the Diamond Model directly captures the tools and techniques used by the adversary?

During the CTI team building process, the manager needs to hire personnel with analytical mindsets who can avoid cognitive biases. Which cognitive bias involves favoring information that confirms pre-existing beliefs while discarding contradictory evidence?