Score Higher on Verified 312-85 | Certified Threat Intelligence Analyst (CTIA) Exam Questions with Answers

Passive DNS monitoring involves collecting data about DNS queries and responses without actively querying DNS servers, thereby not altering or interfering with DNS traffic. This technique allows analysts to track changes in DNS records and observe patterns that may indicate malicious activity. In the scenario described, Enrique is employing passive DNS monitoring by using a recursive DNS server to log the responses received from name servers, storing these logs in a central database for analysis. This approach is effective for identifying malicious domains, mapping malware campaigns, and understanding threat actors' infrastructure without alerting them to the fact that they are being monitored. This method is distinct from active techniques such as DNS interrogation or zone transfers, which involve sending queries to DNS servers, and dynamic DNS, which refers to the automatic updating of DNS records.

In the Threat Intelligence Sharing Model, the Public Tier is used when information is of low sensitivity and can be shared widely across communities, industry groups, or the public domain.

This tier is ideal for sharing generalized threat data, advisories, or non-sensitive indicators that do not pose risks to the organization if disclosed.

Why the Other Options Are Incorrect:

Private tier: Used for highly sensitive intelligence shared only within a small internal group or trusted partners.

Targeted tier: Shared with specific, predefined organizations or partners with a need-to-know basis.

Multitier: Involves multiple sharing levels but is not a standard individual tier type.

Conclusion:

Henry should use the Public Tier, suitable for broader sharing of low-sensitivity information.

Final Answer: B. Public tier

Explanation Reference (Based on CTIA Study Concepts):

As per CTIA’s “Threat Intelligence Sharing Framework,” the public tier enables dissemination of low-sensitivity threat intelligence to trusted communities for collaborative defense.

The methodology described—iterative and incremental prioritization of requirements based on importance—perfectly aligns with the MoSCoW method.

MoSCoW stands for:

M – Must have (critical requirements that are mandatory),

S – Should have (important but not essential),

C – Could have (desirable but optional),

W – Won’t have (this time) (deferred or out of scope).

It is widely used in security, risk management, and software development to determine the priority of tasks or requirements that should be implemented first.

By applying MoSCoW, Marry ensures that critical security requirements (such as protecting core assets) are addressed first before moving on to less critical ones.

Why the Other Options Are Incorrect:

A. Data sampling: Refers to statistical analysis methods, not prioritization.

C. Data visualization: Used to represent data graphically, not for setting priorities.

D. Fusion analysis: Used to integrate multiple data sources for intelligence analysis, not requirement prioritization.

Conclusion:

Marry should use the MoSCoW prioritization methodology to structure and prioritize her organization’s security requirements.

Final Answer: B. MoSCoW

Explanation Reference (Based on CTIA Study Concepts):

In CTIA’s requirement prioritization and planning stages, MoSCoW is used to assign importance levels to intelligence and security requirements for efficient implementation.