Analysis of Intelligence GCTI Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which phase of the intelligence cycle involves identifying the intelligence requirements and establishing the priorities for collection?

   • AProcessing
   • BCollection
   • CDissemination
   • DPlanning and direction
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When tailoring an intelligence product for a technical audience such as SOC analysts, which of the following is most important to include?

   • AExecutive summary with business impact
   • BHigh-level threat landscape overview
   • CDetailed IOCs and detection signatures
   • DStrategic recommendations for board members
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is reviewing a new malware sample that shares code similarities with a known APT group. The sample uses a rarely seen obfuscation technique, and the code similarity is only in a generic library function. The analyst must produce a report for the executive team. What is the most appropriate way to frame the attribution assessment?

   • AAvoid mentioning the code similarity in the report to prevent confusion among executives.
   • BAttribute the malware to the APT group with moderate confidence, citing the obfuscation technique as corroborating evidence.
   • CReport the code similarity as a low-confidence indicator and recommend further analysis before attributing.
   • DState that the malware is likely from the APT group because code reuse is a strong indicator.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An intelligence team is tasked with assessing the risk of a new ransomware campaign targeting the healthcare sector. They have collected open-source reports and internal telemetry. The team must deliver a report to the board of directors. What is the most appropriate next step in the intelligence analysis process?

   • AImmediately write the report using the collected data to meet the deadline.
   • BShare the raw data with the board and let them draw their own conclusions.
   • CEvaluate the collected information for reliability and relevance, then synthesize findings into a tailored report.
   • DCollect more data indefinitely to ensure completeness before writing the report.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An organization is part of an information sharing and analysis center (ISAC) and also has bilateral sharing agreements with two partners. A new threat report contains sensitive information about a vulnerability that is not yet patched. The ISAC wants to publish the report broadly, but one partner has asked the organization not to share it further. What is the most appropriate action?

   • AShare the report with the ISAC but remove the partner's name from it.
   • BShare the report only with the partner who requested confidentiality and not with the ISAC.
   • CPublish the report through the ISAC because sharing broadly helps the community.
   • DDiscuss the partner's concerns with the ISAC and seek a way to share sanitized information that protects the partner's interests.
   Reveal Solution Discussion Select an answer first