CTI interview questions with expert answers

12 questions matching your filters

• Screening Intelligence cycle & F3EAD Difficulty 2/5 Explain the difference between tactical, operational and strategic threat intelligence, with an example of each. A definitional question that becomes diagnostic the moment you are asked for examples — most candidates produce three tactical examples.
• Screening Reporting & stakeholders Difficulty 2/5 A board member asks you what your team does and why it is worth the budget. You have two minutes. What do you say? A communication test disguised as a definitions question. The scoring is almost entirely about whether you can drop the jargon and name a decision.
• Screening Intelligence cycle & F3EAD Difficulty 3/5 You are the first intelligence hire at a company with a working SOC but no CTI function. What do you do in your first 90 days? A senior question that separates people who would start by buying a feed from people who would start by asking who the customer is.
• Technical Intelligence cycle & F3EAD Difficulty 3/5 Your CISO says "I want to know about ransomware." Turn that into something you can actually collect against. Requirements management is where most CTI functions quietly fail, and this question tests it directly.
• Behavioural Reporting & stakeholders Difficulty 3/5 You have been producing reports for six months and you suspect nobody is reading them. How do you find out, and what do you change? A question about the feedback step of the intelligence cycle — the one most teams skip, and the reason many CTI functions get cut.
• Behavioural Intelligence cycle & F3EAD Difficulty 3/5 On the same morning: a new critical vulnerability is being exploited in the wild, the CISO wants a board paper by Friday, and IR needs support on a live case. You cannot do all three. How do you decide? A prioritisation question. The interviewer wants a decision rule, not a heroic claim that you would somehow do everything.
• Technical MITRE ATT&CK Difficulty 4/5 Your CISO has seen an ATT&CK coverage heat map showing 70% of techniques as "covered" and wants to know if that means we are 70% secure. What do you say? A question about the limits of a framework, aimed at analysts senior enough to be asked to defend a metric they did not choose.
• Technical Structured analytic techniques Difficulty 4/5 Walk me through how you would use Analysis of Competing Hypotheses on an intrusion where the evidence is ambiguous. What makes ACH different from just weighing the evidence? ACH questions separate people who can name the technique from people who understand its central counterintuitive claim: supporting evidence is nearly worthless.
• Behavioural Attribution Difficulty 4/5 An executive wants a named attacker for a board slide tomorrow. Your evidence supports clustering the activity but not naming a group. What do you do? A behavioural question testing analytic integrity under stakeholder pressure — and whether you can push back without being obstructive.
• Scenario Standards & sharing Difficulty 4/5 You receive TLP:RED intelligence in a trust group indicating a specific vulnerability is being exploited against your sector. Your organisation is exposed. What do you do? A handling scenario with a deliberate conflict between an obligation and an urgent need to act. Inventing permission is the failure mode.
• Scenario Reporting & stakeholders Difficulty 4/5 The incident is contained. You have 10 minutes with the board next week. The technical picture is still incomplete and attribution is unresolved. What do you present? A communication scenario at the strategic altitude, with the added constraint that you have to be useful while significant things are still unknown.
• Technical Attribution Difficulty 5/5 Which classes of attribution evidence are hardest for an adversary to fake, and which are easiest? How does that change how you weight them? A senior attribution question. The expected answer ranks evidence by cost-to-fake and connects that ranking to how confidence should be assigned.