What is the primary purpose of an indicator of compromise (IOC) in threat detection?

To attribute an attack to a specific threat actor

To identify malicious activity on a system or network

To predict future attack methods

To patch vulnerabilities in software

An intelligence team is analyzing a series of cyber incidents. They have a hypothesis that a single threat actor is responsible. To test this hypothesis, they use a structured analytical technique. What is the most appropriate technique to challenge the hypothesis?

Analysis of Competing Hypotheses (ACH)

GIAC Cyber Threat Intelligence

Domain 3Objective 1

Analysis of Intelligence GCTI Practice Questions (Page 10)

Part of the Intelligence Analysis and Application domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 9–15 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 46–48

46foundation · easy
Which cognitive bias is characterized by the tendency to seek out information that confirms one's pre-existing beliefs while ignoring contradictory evidence?
Select an answer first
47foundation · easy
What is the primary purpose of an indicator of compromise (IOC) in threat detection?
Select an answer first
48application · medium
An intelligence team is analyzing a series of cyber incidents. They have a hypothesis that a single threat actor is responsible. To test this hypothesis, they use a structured analytical technique. What is the most appropriate technique to challenge the hypothesis?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Analysis of Intelligence GCTI Practice Questions (Page 10)

Questions 46–48

Which cognitive bias is characterized by the tendency to seek out information that confirms one's pre-existing beliefs while ignoring contradictory evidence?

What is the primary purpose of an indicator of compromise (IOC) in threat detection?

An intelligence team is analyzing a series of cyber incidents. They have a hypothesis that a single threat actor is responsible. To test this hypothesis, they use a structured analytical technique. What is the most appropriate technique to challenge the hypothesis?

Keep studying — Intelligence Analysis and Application