When disseminating intelligence that includes personal data of individuals, which principle is most important to follow?

Minimize the inclusion of personal data to only what is necessary for the intelligence purpose

Share personal data freely with all partners to enhance collaboration

Anonymize personal data only if the recipient requests it

Include all available personal data to provide complete context

A threat intelligence team is profiling a group that has conducted intrusions in both the energy and healthcare sectors. The group uses custom malware and has a history of long-term espionage. However, recent activity shows the use of ransomware on a healthcare organization. The team must update the profile. What is the most appropriate conclusion?

The ransomware attack is likely a false flag by another group.

The group's capability has decreased because they are using ransomware instead of custom espionage tools.

The group has shifted from espionage to financially motivated crime.

The group's intent may be evolving, but the profile should note the uncertainty and maintain a moderate confidence.

Which structured analytical technique involves generating a list of possible outcomes and then working backward to identify the indicators that would suggest each outcome is occurring?

Analysis of Competing Hypotheses (ACH)

Which of the following is an example of a network-based indicator of compromise (IOC)?

Command and control (C2) domain

MD5 hash of a malicious executable

GIAC Cyber Threat Intelligence

Domain 3Objective 1

Analysis of Intelligence GCTI Practice Questions (Page 6)

Part of the Intelligence Analysis and Application domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 9–15 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 26–30

26foundation · easy
Which component of the threat actor profile is most directly influenced by the target organization's attack surface and security posture?
Select an answer first
27foundation · easy
When disseminating intelligence that includes personal data of individuals, which principle is most important to follow?
Select an answer first
28expert · hard
A threat intelligence team is profiling a group that has conducted intrusions in both the energy and healthcare sectors. The group uses custom malware and has a history of long-term espionage. However, recent activity shows the use of ransomware on a healthcare organization. The team must update the profile. What is the most appropriate conclusion?
Select an answer first
29foundation · easy
Which structured analytical technique involves generating a list of possible outcomes and then working backward to identify the indicators that would suggest each outcome is occurring?
Select an answer first
30foundation · easy
Which of the following is an example of a network-based indicator of compromise (IOC)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Analysis of Intelligence GCTI Practice Questions (Page 6)

Questions 26–30

Which component of the threat actor profile is most directly influenced by the target organization's attack surface and security posture?

When disseminating intelligence that includes personal data of individuals, which principle is most important to follow?

Which structured analytical technique involves generating a list of possible outcomes and then working backward to identify the indicators that would suggest each outcome is occurring?

Which of the following is an example of a network-based indicator of compromise (IOC)?

Keep studying — Intelligence Analysis and Application