Analysis of Intelligence GCTI Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An analyst is reviewing a set of IOCs from a threat intelligence feed. One IOC is a domain that has been observed in multiple unrelated campaigns. Another IOC is a unique file hash. The analyst must prioritize which IOC to use for detection. What is the most appropriate decision?

   • ADiscard the domain because it is not unique.
   • BUse both IOCs equally without prioritization.
   • CPrioritize the domain because domains are more actionable for blocking.
   • DPrioritize the file hash because it is unique and likely more specific to the threat.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which type of intelligence product is typically a short, time-sensitive document that provides immediate warning of a developing threat or incident?

   • AAlert or warning notice
   • BIntelligence report
   • CAnnual threat review
   • DThreat assessment
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In intelligence analysis, what does the confidence level of a judgment represent?

   • AThe certainty that the judgment is correct based on available evidence and reasoning
   • BThe number of sources used to produce the judgment
   • CThe likelihood that the adversary will achieve their objectives
   • DThe severity of the threat posed by the adversary
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An analyst is profiling a threat actor that has been observed using a mix of sophisticated and unsophisticated techniques. The actor has targeted both large enterprises and small businesses. The analyst must determine the actor's likely motivation. Which evidence would be most indicative of a financially motivated actor?

   • AThe actor uses ransomware and demands payments in cryptocurrency.
   • BThe actor targets a wide range of industries.
   • CThe actor operates during business hours in the target's timezone.
   • DThe actor uses custom malware that is not publicly available.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A cybersecurity team wants to share threat intelligence with a partner organization. The intelligence includes sensitive details about a vulnerability in a third-party product that is not yet patched. What is the most appropriate action?

   • APublish the vulnerability details publicly to pressure the vendor to fix it faster.
   • BShare the full technical details with the partner to ensure they can defend themselves.
   • CWait until the vendor releases a patch before sharing any information with the partner.
   • DShare a sanitized summary with the partner and provide full details only under a non-disclosure agreement.
   Reveal Solution Discussion Select an answer first