Michael, a threat analyst, works in an organization named TechTop, was asked to conduct a cyber- threat intelligence analysis. After obtaining information regarding threats, he has started analyzing…

Question

Options

• AUnknown unknowns
• BUnknowns unknown
• CKnown unknowns
• DKnown knowns

• A
  3% (1)
• B
  8% (3)
• C
  73% (27)
• D
  16% (6)

Explanation

Option C is correct because Michael has already identified that threats exist (he "obtained information"), but is still in the process of analyzing and understanding their nature - meaning he knows there are gaps in his understanding that he hasn't yet filled. This is the definition of Known Unknowns: awareness of what you don't yet fully know.

Why the distractors are wrong:

• A (Unknown unknowns): Would apply before any intelligence is gathered - threats TechTop doesn't even know exist yet. Michael has already collected information, so he's past this stage.
• B (Unknowns unknown): This is a deliberately reversed, nonsensical phrasing - not a recognized CTI stage. It exists purely as a trap for careless readers.
• D (Known knowns): Represents threats that are fully understood and actionable. Michael hasn't finished his analysis yet, so he hasn't reached this stage.

Memory tip: Map it to a study analogy - "Known unknowns" is like knowing you haven't studied Chapter 5 yet. You know the gap exists. "Unknown unknowns" is not even knowing Chapter 5 was on the syllabus. Michael knows the threats are there; he just doesn't understand them yet - classic known unknown.

No community discussion yet for this question.