Analysis of Intelligence GCTI Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An intelligence analyst must produce a product for two different audiences: the SOC team and the executive leadership. The SOC team needs technical details and IOCs, while executives need a high-level summary of risks and recommendations. What is the most appropriate approach?

   • AProduce a high-level summary for both audiences to keep it simple.
   • BCreate two separate products tailored to each audience's needs.
   • CSend the raw intelligence to both audiences and let them interpret it.
   • DProduce one detailed report and send it to both audiences.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An intelligence team is producing a strategic assessment on the likelihood of a state-sponsored cyber attack. They have limited information and must deliver the assessment in 48 hours. The team has two analysts with different views: one believes the attack is likely, the other believes it is unlikely. What is the most appropriate way to proceed?

   • ADelay the assessment until more information is available.
   • BAverage the two analysts' opinions to produce a single probability.
   • CChoose the more experienced analyst's view to ensure accuracy.
   • DUse a structured technique like ACH to evaluate the evidence and document the disagreements.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A threat intelligence team has produced a detailed technical analysis of a new exploit. The team needs to inform the executive leadership about the potential business impact. Which type of intelligence product is most appropriate?

   • AA raw intelligence feed with all technical details
   • BA tactical intelligence report with IOCs and detection rules
   • CA strategic intelligence report focusing on risks, business impact, and recommended actions
   • DAn operational intelligence report detailing specific campaigns and TTPs
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A threat intelligence analyst wants to share a report with a partner organization but is concerned about the sensitivity of the information. The analyst wants to ensure the partner does not share the report with others without permission. What should the analyst do?

   • APost the report on a secure portal with access controls.
   • BEncrypt the report with a strong password and send it via email.
   • CVerbally ask the partner not to share the report.
   • DUse the Traffic Light Protocol (TLP) to mark the report as TLP:RED.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An intelligence analyst receives a request from a law enforcement agency to provide detailed information about a customer's network activity that was captured during a threat investigation. The analyst's organization has a policy that prohibits sharing customer data without a subpoena. What should the analyst do?

   • AProvide the information but anonymize the customer's identity.
   • BComply with the request because law enforcement has the authority to request this information.
   • CEscalate the request to the organization's legal counsel to determine the appropriate response.
   • DRefuse to provide any information and terminate the conversation.
   Reveal Solution Discussion Select an answer first