A threat intelligence team is tasked with producing a report on a new ransomware family. The team has collected samples and observed infections. According to the intelligence analysis process, what should the team do after collecting and processing the data?

Request feedback from stakeholders to refine the collection plan.

Analyze the data to identify patterns, determine the threat's capabilities, and assess the impact.

Collect more data to ensure completeness before starting analysis.

Disseminate the report to all stakeholders immediately.

A threat intelligence team produces a monthly report for the board of directors. The report includes technical details about malware and IOCs. The board members have complained that the report is too technical and not actionable. What should the team do to improve the report?

Rewrite the report to focus on business risks, trends, and recommended strategic actions.

Remove all technical content and only provide a summary.

Send the report to the security team instead of the board.

Add more technical details to help the board understand the threats.

What is the primary purpose of information sharing and analysis centers (ISACs) in the context of cyber threat intelligence?

To replace the need for internal security operations centers

To provide a platform for sharing threat intelligence within a specific sector

To sell threat intelligence to government agencies

To regulate cybersecurity practices across industries

An intelligence analyst is preparing a briefing for a non-technical executive audience. The briefing must cover a recent cyber attack and its implications. The analyst has detailed technical information, including IOCs and malware analysis. What is the most appropriate way to present this information?

Use a mix of technical and non-technical content to cater to all audiences.

Include all technical details to ensure the executives have the full picture.

Provide the IOCs and ask the executives to share them with their technical teams.

Focus on the business impact, risk, and recommended actions, avoiding technical jargon.

An analyst receives a request from a law enforcement agency to share threat intelligence about a specific threat actor. The intelligence includes personal data of suspected individuals. What is the most appropriate action?

Consult the organization's legal counsel and follow established data-sharing policies.

Share the full intelligence package because law enforcement has the authority to request it.

Anonymize the personal data before sharing to protect privacy.

Refuse to share any information due to privacy concerns.

GIAC Cyber Threat Intelligence

Domain 3Objective 1

Analysis of Intelligence GCTI Practice Questions (Page 8)

Part of the Intelligence Analysis and Application domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 9–15 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 36–40

36application · medium
A threat intelligence team is tasked with producing a report on a new ransomware family. The team has collected samples and observed infections. According to the intelligence analysis process, what should the team do after collecting and processing the data?
Select an answer first
37expert · hard
A threat intelligence team produces a monthly report for the board of directors. The report includes technical details about malware and IOCs. The board members have complained that the report is too technical and not actionable. What should the team do to improve the report?
Select an answer first
38foundation · easy
What is the primary purpose of information sharing and analysis centers (ISACs) in the context of cyber threat intelligence?
Select an answer first
39expert · hard
An intelligence analyst is preparing a briefing for a non-technical executive audience. The briefing must cover a recent cyber attack and its implications. The analyst has detailed technical information, including IOCs and malware analysis. What is the most appropriate way to present this information?
Select an answer first
40application · medium
An analyst receives a request from a law enforcement agency to share threat intelligence about a specific threat actor. The intelligence includes personal data of suspected individuals. What is the most appropriate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.