Analysis of Intelligence GCTI Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an ethical obligation of an intelligence analyst when producing a finished intelligence product?

   • AAvoid mentioning uncertainties to provide clear, decisive conclusions
   • BEmphasize evidence that supports the desired conclusion to please stakeholders
   • CShare preliminary findings with the public before official release
   • DPresent all evidence, including information that contradicts the main judgment
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An analyst is using Analysis of Competing Hypotheses (ACH) to evaluate three hypotheses about a series of intrusions. The analyst has collected evidence that supports all three hypotheses to some degree. The analyst notices that one hypothesis is supported by evidence that is also consistent with the other hypotheses. What should the analyst do?

   • AConclude that the hypothesis with the most supporting evidence is correct.
   • BTreat that evidence as less diagnostic and focus on evidence that distinguishes between the hypotheses.
   • CIncrease the confidence in all hypotheses because they are supported.
   • DDiscard the evidence that supports all hypotheses.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An analyst is writing a threat intelligence report that includes information about a vulnerability in a vendor's product. The analyst wants to share the report with the vendor to help them fix the issue. What is the most important consideration?

   • ASell the vulnerability information to the highest bidder.
   • BPublish the vulnerability publicly to pressure the vendor into fixing it quickly.
   • CShare the report only with the analyst's own organization and not with the vendor.
   • DCoordinate the disclosure with the vendor to avoid exposing the vulnerability before a patch is available.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security operations center (SOC) receives a threat intelligence report containing a list of file hashes, domains, and IP addresses associated with a recent campaign. The SOC wants to use this report to proactively hunt for the threat in their environment. What is the most effective first step?

   • ABlock all the IP addresses at the firewall immediately.
   • BSearch the environment for the file hashes and domains using the SIEM and endpoint detection tools.
   • CAdd the IOCs to a threat intelligence platform and wait for alerts.
   • DSend the report to the executive team for awareness.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company has detected a novel malware variant and wants to share the indicators with other organizations in its sector. The company is concerned about legal exposure and wants to ensure the sharing is done properly. What is the most appropriate action?

   • APost the indicators on a public forum to reach the widest audience.
   • BWait for a government mandate before sharing any information.
   • CShare the indicators through an established Information Sharing and Analysis Center (ISAC) with a traffic light protocol (TLP) designation.
   • DShare the indicators only with direct competitors to avoid leaking to the public.
   Reveal Solution Discussion Select an answer first