Which statement best defines a cyber threat campaign?

A single intrusion event that occurs within a short time frame

A series of related malicious activities conducted by a threat actor over time to achieve a strategic objective

The process of attributing an intrusion to a specific threat actor

A collection of malware samples that share similar code signatures

How should an analyst communicate attribution when the evidence is limited to a single malware hash that is also used by other actors?

As a medium-confidence attribution because the hash is unique to the actor

As an unconfirmed attribution that should not be reported to stakeholders

As a low-confidence attribution, noting that the evidence is insufficient to definitively identify the actor

As a high-confidence attribution because the malware hash is a strong indicator

A threat intelligence analyst is profiling a threat actor that has targeted multiple healthcare organizations. The analyst observes that the actor operates during business hours in a specific time zone, uses custom malware, and appears motivated by financial gain. Which profile best describes this actor?

A hacktivist with irregular hours and publicly available tools

A financially motivated actor with a regular operational schedule and custom tooling

A state-sponsored actor with a political motivation and advanced capabilities

An insider threat with physical access to the healthcare networks

A threat intelligence team is profiling an actor that has been observed using publicly available exploit kits, targeting small businesses, and operating during weekends. The team wants to infer the actor's likely motivation and capability. Which profile is most consistent with these observations?

An insider threat with privileged access to the targeted businesses

A hacktivist with a political agenda and advanced custom tools

A highly skilled state-sponsored actor with strategic targeting

A low-to-moderately skilled actor with opportunistic targeting and likely financial motivation

Which piece of evidence would most likely indicate a false flag operation?

The attack's TTPs are a perfect match to a known actor, but the infrastructure is newly registered and not consistent with that actor's historical patterns

The attack uses a zero-day vulnerability that is not publicly known

The attack occurs during a time when the known actor is typically inactive

The malware used in the attack is identical to malware used by a known actor

GIAC Cyber Threat Intelligence

Domain 5Objective 2

Campaigns and Attribution GCTI Practice Questions (Page 5)

Part of the Advanced Analysis Techniques domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 7–12 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 21–25

21foundation · easy
Which statement best defines a cyber threat campaign?
Select an answer first
22foundation · easy
How should an analyst communicate attribution when the evidence is limited to a single malware hash that is also used by other actors?
Select an answer first
23application · medium
A threat intelligence analyst is profiling a threat actor that has targeted multiple healthcare organizations. The analyst observes that the actor operates during business hours in a specific time zone, uses custom malware, and appears motivated by financial gain. Which profile best describes this actor?
Select an answer first
24application · medium
A threat intelligence team is profiling an actor that has been observed using publicly available exploit kits, targeting small businesses, and operating during weekends. The team wants to infer the actor's likely motivation and capability. Which profile is most consistent with these observations?
Select an answer first
25foundation · easy
Which piece of evidence would most likely indicate a false flag operation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.