Analysis of Intelligence GCTI Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a common standard used to structure and share cyber threat intelligence in a machine-readable format?

   • AJSON
   • BTCP/IP
   • CHTML
   • DSTIX (Structured Threat Information Expression)
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An intelligence analyst is preparing a report that includes information about a vulnerability in a widely used product. The analyst's organization has a policy that requires responsible disclosure. The analyst has discovered that the vendor has not responded to multiple notifications. What is the most ethical course of action?

   • AKeep the vulnerability secret indefinitely to avoid harm.
   • BShare the vulnerability with a select group of customers only.
   • CSell the vulnerability information to a government agency.
   • DPublish the vulnerability details after a reasonable waiting period to pressure the vendor.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst is building a threat actor profile for a group that has targeted financial institutions in Southeast Asia. The group uses publicly available exploit kits and sends phishing emails with themes related to regional banking regulations. They operate during business hours in the UTC+7 timezone. What is the most defensible conclusion about this group's capability and intent?

   • AThe group's timezone of operation proves they are located in Southeast Asia.
   • BThe group has low intent because they only use phishing and not zero-day exploits.
   • CThe group has high capability because they use exploit kits, which are advanced tools.
   • DThe group has moderate capability and a clear intent to target financial institutions in the region.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst discovers a suspicious file on a server. The analyst extracts a hash, a domain, and an IP address from the file's behavior. Which of these IOCs is most likely to be a reliable indicator of compromise for detecting this specific malware?

   • AThe IP address
   • BThe file hash
   • CAll are equally reliable
   • DThe domain
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During incident response, an analyst discovers a unique domain name used for command-and-control (C2) and a unique malware hash. The C2 domain is registered with a privacy service. The analyst must produce an intelligence report for the SOC team. What is the most appropriate way to present these IOCs?

   • AOnly share the malware hash because domains are less reliable due to privacy registration.
   • BList the domain and hash as high-confidence IOCs because they are unique to this incident.
   • CRecommend blocking the domain and hash immediately without further analysis to speed up response.
   • DProvide the domain and hash with context, including the confidence level and recommended detection rules.
   Reveal Solution Discussion Select an answer first