Requirements Planning Direction And Review practice questions

Recover (RC)

Why it fails: The Recover function focuses on restoration of systems and services affected by security incidents.

Respond (RS)

Why it fails: The Respond function deals with containment, mitigation, and analysis during and after an incident.

Protect (PR)

Why it fails: The Protect function covers identity management, access control, and data security protective technology.

Symmetric Key Cryptographic Padding

Why it fails: Symmetric key padding is a cryptographic data formatting method, not an intelligence analysis technique.

Randomized MAC Address Rotation

Why it fails: MAC address rotation is a technical networking feature used for wireless privacy, not an analytic technique.

Approve the annual cybersecurity budget and sign off on vendor contract renewals for the security organization

Why it fails: Budget approval and contract execution sit with executive management or the CISO, not an intelligence requirements review board. While the board may advise on intelligence-related spending, its mandate is to keep requirements aligned and prioritized, and presenting it as the budget authority misstates its governance role.

Configure firewall and EDR detection rules so that indicators produced by the team are enforced on perimeter and endpoint controls

Why it fails: Detection engineering and control enforcement belong to security operations, not to the governance body that manages requirements. The review board may request that indicators be operationalized, but it does not itself tune firewall or EDR rules; conflating the two would confuse the intelligence lifecycle with the operational response process.

To schedule routine penetration testing intervals across the enterprise network

Why it fails: PIRs define the intelligence questions that guide collection and analysis; they do not schedule penetration tests, which are offensive security assessments run independently of the intelligence cycle. It is tempting because PIRs do shape security priorities, and penetration testing is the correct activity when validating defences rather than directing collection.

To outline the budget allocation for commercial threat feed subscriptions

Why it fails: Budget allocation belongs to resource planning, not requirement definition; PIRs specify what intelligence decision-makers need answered, prioritised by the intelligence question. Allocating feed spend is tempting because PIRs do shape collection priorities, but the framework's output is prioritised questions, not funding decisions.

To establish automated firewall blocklists for known malicious IP addresses

Why it fails: PIRs articulate the intelligence questions leadership needs answered to support decisions; they do not generate firewall blocklists, which are a technical control fed by finished intelligence. It is tempting because PIRs do drive collection priorities, and blocklists are the correct output once indicators have been produced and validated.

Infrastructure

Why it fails: Infrastructure captures physical and logical communication structures, such as command-and-control servers and domains, not the adversary's tools and techniques. It is tempting because infrastructure does map adversary-controlled assets, and it would be the correct vertex when scoping hosting, domains or delivery channels rather than capability.

Adversary

Why it fails: Adversary captures the actor — their identity, motivation and attribution — not the tooling. It is tempting because adversary profiling is central to requirements planning, and this vertex is correct when the question asks who is conducting the intrusion rather than how.

Victim

Why it fails: Victim is the target vertex, recording the affected organisation, assets and impact — it holds no tool or technique data. It is tempting because scoping a financial institution's exposure naturally centres on the victim, and victimology is genuinely the correct vertex when profiling who is being targeted and why.

Immediately publish the raw telemetry to the corporate intranet without validation

Why it fails: Raw telemetry must be validated, enriched and assessed before dissemination; publishing it directly breaches the collection-to-dissemination workflow and risks spreading unverified indicators. Immediate publication would be correct only after analysts have confirmed accuracy and applied handling caveats during the dissemination phase.

Archive the RFI immediately as operational queries fall outside the scope of CTI

Why it fails: Operational RFIs about new malware fall squarely within CTI scope, so archiving discards a valid requirement before triage, prioritisation and tasking occur. Archiving would be correct only once an RFI has been answered, closed and retained for audit or historical reference.

Initiate an immediate red-team attack campaign against the external supplier

Why it fails: An RFI is answered by collecting and validating information, not by launching offensive operations; red-team campaigns belong to later active-collection or counter-intelligence stages, and attacking a supplier would breach legal and scope boundaries. It is tempting because RFIs can trigger follow-on tasking, but the immediate next step is analyst research and response.

Vulnerability Assessor

Why it fails: Vulnerability Assessors scan systems and prioritise technical weaknesses; they do not translate threat trends into business risk for executives. The role is tempting because vulnerability data feeds strategic intelligence, but the analyst role owns that board-level translation, not the assessor.

Malware Reverse Engineer

Why it fails: Malware Reverse Engineers disassemble malicious code to extract indicators and capabilities, producing tactical, technical output rather than board-level business risk assessments. The role tempts because reverse engineering supports intelligence, yet the analyst role, not the engineer, converts trends into executive-facing risk language.

Incident Responder

Why it fails: Incident Responders contain and remediate active incidents at the tactical level; they do not produce board-facing business risk assessments from strategic threat trends. That role is correct when the requirement is hands-on investigation, containment and eradication rather than executive-level translation.

Elimination of the need for external commercial threat feeds

Why it fails: Centralisation consolidates analysts, tooling and processes; it does not remove dependence on commercial feeds, which supply external adversary and vulnerability data no internal team generates. Eliminating feeds suits an organisation with mature internal collection and sharing arrangements, not the typical centralised model.

Complete elimination of communication silos with local IT helpdesks

Why it fails: Centralisation concentrates analysts away from business units, so communication with local IT helpdesks still requires deliberate liaison channels; silos are not eliminated. Removing silos suits a distributed model where analysts sit within each unit, whereas centralisation's advantage is consistent tradecraft and unified intelligence production.

Faster deployment of endpoint agents on localized operational technology networks

Why it fails: Endpoint agent rollout depends on OT network access and change-control procedures at each site, which centralisation does not alter; distributed analysts embedded locally would handle that deployment. Faster agent deployment suits a distributed structure, not the coordination, standardisation and shared visibility that centralisation delivers.

Social media marketing agencies

Why it fails: Marketing agencies hold campaign and audience data, not adversary tradecraft or sector incident reporting, so they cannot supply threat requirements. They would be consulted for brand or outreach messaging; sector-specific threat intelligence comes from ISACs, sector CERTs and internal security leadership.

Commercial real estate brokers

Why it fails: Commercial property brokers deal with leases, tenants and valuations, holding no visibility into cyber threats against the organisation's sector. They would be consulted for facilities or site acquisition decisions; accurate sector threat requirements come from ISACs, sector CERTs and internal security teams.

Consumer product retail vendors

Why it fails: Retail vendors supply product and supply-chain commercial data, not adversary intelligence or sector incident reporting, so they cannot define threat requirements. They would be consulted for merchandising or distribution planning; sector-specific threat intelligence comes from ISACs, sector CERTs and internal security leadership.

Number of threat intelligence blog posts published on the corporate website

Why it fails: Publication volume counts output, not whether intelligence matched collection requirements or informed decisions, so it cannot measure quality or relevance. It is tempting because tracking published posts is easy and shows program activity, and it would suit a communications or awareness objective rather than an intelligence effectiveness KPI.

Total gigabytes of threat data ingested from commercial feeds per month

Why it fails: Volume ingested measures feed consumption, not whether intelligence answered stakeholder requirements; quality is assessed through feedback, accuracy, and decision impact. It is tempting because larger feeds appear comprehensive, and it would be correct as a coverage or collection-capacity indicator.

Total number of security alerts generated by the SIEM

Why it fails: SIEM alert volume reflects detection workload, not the quality or relevance of finished intelligence, and correlates with tuning and noise rather than analytic value. It is tempting because SIEM data is readily available, and alert counts would be the right metric for measuring detection coverage or SOC operational load.

Network Forensic Packet Capture Analysis

Why it fails: Packet capture analysis is a technical investigative technique used post-compromise or during deep network troubleshooting.

Signature-Based Intrusion Detection Analysis

Why it fails: Signature-based detection is an operational mechanism for matching known malicious byte patterns in network traffic.

Vulnerability Scoring via CVSS v3.1 Base Metrics

Why it fails: CVSS scoring measures technical software flaws, not the intent or motivations of threat actors targeting business events.

Financial Intelligence

Why it fails: Financial intelligence examines money flows, fraud and illicit financing, bearing no relation to file hashes, IP addresses or domain names. It is tempting in fraud or AML contexts, but technical indicators fall under technical intelligence, which catalogues adversary infrastructure and malware artefacts.

Operational Intelligence

Why it fails: Operational intelligence covers adversary campaigns and imminent threats, not the raw technical indicators themselves. It is tempting because operational reporting often cites hashes and domains, but those artefacts are produced by technical intelligence, which converts them into detection and hunting content.

Strategic Intelligence

Why it fails: Strategic intelligence addresses long-term geopolitical and business risk trends, not file hashes, IP addresses or domain names. It is tempting because it frames the CTI programme's direction, but technical indicators belong to technical intelligence, which maps artefacts to adversary infrastructure and campaigns.

Collect all CVEs published daily by the National Vulnerability Database (NVD)

Why it fails: Dumping every daily NVD CVE is unfocused collection with no link to the CRO's ransomware supply chain concern, producing volume rather than prioritised intelligence. Broad vulnerability feeds suit a vulnerability management programme, not a requirement scoped to supplier ransomware risk.

Deploy endpoint detection and response (EDR) agents to all contractor laptops

Why it fails: EDR deployment is a defensive control that generates endpoint telemetry, not a formal intelligence requirement defining what the CTI team must collect and report on supply chain ransomware. EDR would be the right answer if the question asked how to detect ransomware execution on contractor endpoints.

Execute regular phishing simulations for all internal business unit employees

Why it fails: Phishing simulations are a security awareness control, not an intelligence requirement, so they produce no collection or reporting on ransomware supply chain threats. They would be correct if the CRO's concern were employee susceptibility to credential theft, which simulations directly measure.

Disable all external threat intelligence feeds to reduce noise in the security operations center

Why it fails: Disabling external feeds removes the supplier and third-party indicators that would surface supply chain intrusions earlier, worsening the gap. It is tempting because feed volume genuinely creates alert noise and analyst fatigue, which is the right adjustment when the problem is excessive false positives rather than missing external visibility.

Reassign all malware reverse engineering tasks to helpdesk support personnel

Why it fails: Reassigning reverse engineering to helpdesk support removes the specialist capability needed to characterise supply chain implants, deepening the detection gap. It is tempting because redistributing tasks can relieve analyst workload and cut costs, which is the right adjustment when the shortfall is resource capacity rather than scarce technical expertise.

Increase the budget for automated SIEM log retention from 30 days to 90 days

Why it fails: Extending SIEM log retention addresses forensic reconstruction after an incident, not the direction and planning gaps that let supply chain intrusions go undetected. It is tempting because longer retention genuinely aids post-incident timeline analysis and compliance evidence, which is the right adjustment when the shortfall is investigation depth rather than detection coverage.

Availability Heuristic

Why it fails: The availability heuristic judges likelihood by how easily examples come to mind, not by selectively rejecting contradictory evidence. Confirmation bias matches the stem. It tempts because both skew analytic judgement, yet availability concerns recall salience, not protecting pre-existing beliefs from disconfirming data.

Mirror Imaging

Why it fails: Mirror imaging assumes adversaries reason as you would, projecting your own logic onto them. It does not describe discarding evidence that contradicts existing beliefs; confirmation bias does. It tempts because both are analytic pitfalls in CTI, but mirror imaging concerns adversary modelling, not evidence selection.

Bandwagon Effect

Why it fails: The bandwagon effect is adopting beliefs because others hold them, not filtering evidence to fit prior views. Confirmation bias describes that evidence-selection pattern. It tempts because both distort judgement, but the bandwagon effect concerns social conformity rather than discarding contradictory data.

Phishing email headers received by internal mail servers from external domains

Why it fails: Phishing email headers map to the Delivery phase, where the weaponised payload reaches the victim, not to Weaponization, which covers building the exploit and payload. Collecting headers is tempting because it is readily available, but it would be correct when the analyst needs to detect or block adversary delivery activity.

File hashes and indicators associated with credential dumping tools like Mimikatz

Why it fails: File hashes and Mimikatz indicators map to the Actions on Objectives or Exploitation phases, where the tool actually runs on a host. Weaponization covers coupling an exploit with a deliverable payload, such as a malicious document or macro. Hash collection is tempting because it is standard threat intel, but it detects post-delivery artefacts.

Network traffic logs showing data exfiltration over encrypted channels

Why it fails: Exfiltration traffic belongs to the Command and Control or Actions on Objectives phases, occurring after compromise. Weaponization concerns building the deliverable, such as a weaponised PDF or Office macro. Traffic logs are tempting because they are routinely collected, but they cannot reveal pre-delivery payload construction.

The number of firewall rule changes approved by change management

Why it fails: Firewall rule changes measure remediation or change-management throughput, not intelligence collection performance. It is tempting because change volume is readily available from ticketing systems, and it would be correct for tracking operational security workload, but it captures no data about sources, feeds or collection coverage.

The total financial cost of commercial intelligence subscriptions divided by the number of employees

Why it fails: Subscription cost per employee measures budget allocation, not collection efficiency, which compares collected intelligence against collection requirements. It is tempting because cost metrics are simple to derive, and it would be correct for cost-per-analyst budgeting, but it says nothing about whether sources delivered the required data.

The average time it takes an analyst to write a quarterly report

Why it fails: Report-writing duration measures analyst productivity, not how much of the required intelligence was actually collected against the collection plan. It is tempting because reporting effort is easy to track, and it would be correct for assessing analyst workload or process turnaround, not collection efficiency.

Processing and Exploitation

Why it fails: Processing and exploitation converts raw collected data into usable intelligence and sits after collection, so it cannot feed back into direction and planning. It is tempting as an early-stage activity, but the phase that directly informs requirements review is dissemination and feedback.

Automated Malware Sandboxing

Why it fails: Sandboxing is a malware analysis technique, not an intelligence cycle phase, so it cannot feed direction and planning. It is tempting because sandbox output supplies technical indicators, but requirements review draws on the dissemination and feedback phase, which returns consumer needs to planners.

Tactical Log Ingestion

Why it fails: Tactical log ingestion is a collection activity, feeding the processing and exploitation phase, not direction and planning. It is tempting because logs supply raw data that eventually informs requirements, but the review needs feedback from dissemination and use, which adjusts collection priorities before planning begins.

Corporate real estate leasing committees

Why it fails: Real estate leasing committees consume property and facilities data, not threat intelligence on adversaries or indicators. CTI planning addresses strategic, operational and tactical consumers. Leasing would be relevant to a facilities risk register, not to categorising intelligence consumers.

External consumer product marketing teams

Why it fails: Product marketing teams consume market and competitor data, not cyber threat intelligence about adversaries, campaigns or indicators. The three consumer tiers are strategic, operational and tactical. Marketing would be relevant to a competitive-intelligence programme, not a CTI requirements plan.

The marketing budget of the threat intelligence vendor

Why it fails: Marketing spend measures promotion, not the feed's accuracy, timeliness or fit to the organisation's intelligence requirements, so it cannot justify vendor selection. It is tempting because budget size can imply vendor stability, but vetting criteria address data quality and relevance, not advertising expenditure.

Whether the vendor shares all threat data publicly on open-source social media platforms

Why it fails: Public social-media sharing says nothing about collection coverage, accuracy or relevance to the organisation's intelligence requirements, so it cannot vet a feed. It tempts because open-source collection is a legitimate intelligence discipline, but that concerns sourcing methods, not vendor evaluation criteria such as timeliness and reliability.

The total number of unverified IP addresses included in the feed without regard to false positive rates

Why it fails: Raw volume of unverified indicators ignores false-positive rates, which determine whether detections are actionable; a large feed of unvalidated IPs floods analysts with noise. It tempts because indicator count appears to signal coverage, yet vetting requires accuracy, relevance and validation, not sheer quantity.