Analysis of Intelligence GCTI Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst is assessing whether a recent intrusion was conducted by a known state-sponsored group. The intrusion used a custom tool that has only been seen in that group's operations, but the victim is a small non-profit that does not align with the group's typical targets. What is the most appropriate confidence level for the attribution?

   • ANo confidence because attribution is impossible without a confession.
   • BLow confidence because the target does not align with the group's interests.
   • CHigh confidence because the custom tool is unique to the group.
   • DModerate confidence because the tool is strong evidence but the target is atypical.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In threat actor profiling, which element describes the actor's access to resources, funding, and technical expertise?

   • AModus operandi
   • BOpportunity
   • CIntent
   • DCapability
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An intelligence team is analyzing a series of attacks that appear to be linked. The team has a strong hypothesis that a single group is responsible. However, one analyst points out that the attacks could be the work of multiple groups using similar tools. What is the most appropriate way to address this disagreement?

   • AIgnore the dissenting view to maintain team cohesion.
   • BConduct a red team exercise to challenge the single-group hypothesis.
   • CUse ACH to systematically compare the single-group hypothesis against the multiple-group hypothesis.
   • DAccept the majority view because most analysts support the single-group hypothesis.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An analyst is assessing the confidence of an attribution to a known advanced persistent threat (APT) group. The evidence includes a unique malware family, a specific TTP, and a victim profile that matches the group's historical targeting. However, the analyst discovers that the malware was leaked online and could be used by other actors. How should this affect the confidence level?

   • AIgnore the leak because it does not change the technical evidence.
   • BMaintain high confidence because the TTP and victim profile are still strong indicators.
   • CIncrease confidence because the leak shows the group is willing to share tools.
   • DReduce confidence because the malware is no longer unique to the group.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A threat intelligence team is tasked with producing a weekly report for the CISO. The team has limited resources and must decide how to allocate effort. The CISO wants to know the top threats facing the organization. The team has access to a commercial threat feed, internal telemetry, and open-source reporting. The team notices that the commercial feed provides many alerts but with high false positives. What is the best approach?

   • AUse only open-source reporting to ensure unbiased information.
   • BUse only internal telemetry to avoid external noise.
   • CPrioritize internal telemetry and open-source reporting, and use the commercial feed to validate findings.
   • DRely primarily on the commercial feed because it is comprehensive.
   Reveal Solution Discussion Select an answer first