Analysis of Intelligence GCTI Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the intelligence analysis process, which step immediately follows the collection of raw data and precedes the production of the final intelligence report?

   • APlanning and direction
   • BDissemination and feedback
   • CProcessing and exploitation
   • DAnalysis and production
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An intelligence analyst discovers that a threat actor is using a vulnerability in a widely used software product. The vendor has not yet released a patch. The analyst wants to share this information with a closed community of trusted peers. What is the most appropriate action?

   • ANotify the vendor privately and share only a sanitized warning with the community.
   • BShare the vulnerability details with the closed community to help them prepare.
   • CPublish the vulnerability publicly to force the vendor to act faster.
   • DKeep the information confidential until the vendor releases a patch.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An incident response team has identified a set of IOCs from a compromised host. The IOCs include a malicious IP address, a domain, and a file hash. The team wants to share these IOCs with a threat intelligence platform. What is the most appropriate way to ensure the IOCs are useful to other organizations?

   • AShare the IOCs with context, including the associated threat actor, attack vector, and recommended detection rules.
   • BOnly share the file hash because it is the most reliable IOC.
   • CShare the IOCs only after the incident is fully contained to avoid alerting the attacker.
   • DShare the IOCs as raw data without context to allow each organization to interpret them.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following best describes the limitation of attribution in cyber threat intelligence?

   • AAttribution is only possible for state-sponsored actors
   • BAttribution can be difficult because attackers can use false flags and obfuscation techniques
   • CAttribution is based solely on the malware used in an attack
   • DAttribution is always accurate when technical evidence is available
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is profiling a threat actor that has been observed using custom malware, targeting financial institutions, and operating during business hours in the target's timezone. The analyst wants to assess the actor's capability and intent. Which combination of factors is most relevant?

   • AThe sophistication of the malware and the selection of high-value targets.
   • BThe actor's use of a specific VPN provider and the time of day of operations.
   • CThe number of IOCs reported and the number of countries affected.
   • DThe actor's preferred encryption algorithm and the type of command-and-control protocol.
   Reveal Solution Discussion Select an answer first