Cyber Threat Intelligence Lifecycle Flashcards
7 cards from real CCP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Cyber Threat Intelligence Lifecycle flashcards as text
During the 'Direction' phase of the CTI lifecycle, what is the primary output produced?
Answer: Intelligence requirements and collection priorities
The Direction phase establishes intelligence requirements that guide what information will be collected and how resources are prioritized.
A CTI analyst discovers that raw OSINT data contains significant noise and irrelevant information. Which lifecycle phase should address this problem?
Answer: Processing
The Processing phase normalizes, filters, and structures raw collected data to remove noise and make it suitable for analysis.
Which feedback mechanism in the CTI lifecycle ensures intelligence products remain aligned with stakeholder needs over time?
Answer: Post-dissemination feedback loops
Post-dissemination feedback loops allow consumers to evaluate the intelligence's relevance and accuracy, informing future Direction phase decisions.
An organization wants to understand the long-term strategic motivations of a nation-state adversary. Which type of intelligence should the CTI lifecycle produce?
Answer: Strategic intelligence
Strategic intelligence addresses high-level adversary motivations, geopolitical context, and long-term trends to support executive decision-making.
During the Analysis phase, a CTI team uses the Diamond Model to characterize an intrusion. Which four core features does this model relate?
Answer: Adversary, capability, infrastructure, and victim
The Diamond Model links adversary, capability, infrastructure, and victim as the four core features of any intrusion event.
What distinguishes 'data' from 'intelligence' in the context of the CTI lifecycle?
Answer: Data is raw and unprocessed; intelligence is analyzed and contextualized
Intelligence is the product of analyzing and contextualizing raw data to produce actionable insights, whereas data alone lacks meaning without processing.
A CTI team is tasked with producing indicators to block active phishing campaigns within 24 hours. Which intelligence type best fits this requirement?
Answer: Tactical intelligence
Tactical intelligence provides near-real-time indicators of compromise (IOCs) such as IPs, domains, and hashes that defenders can act on immediately.