A threat intelligence team receives indicators of compromise (IOCs) from multiple sources in different formats: STIX, CSV, and plain text. The team needs to correlate these IOCs with internal logs. What should the team do first to enable effective correlation?

Create a separate database for each format and correlate manually.

Convert all IOCs into a standardized format, such as STIX, and validate the data for completeness.

Store the raw formats as received and manually search each source when needed.

Use only the CSV source because it is easiest to import into a database.

A threat intelligence team stores sensitive data about ongoing investigations in a shared network drive. The team wants to ensure that only analysts with a specific clearance level can access the data, and that access is logged. What should the team implement?

Use role-based access control (RBAC) to grant access only to analysts with the required clearance, and enable auditing on the folder.

Compress the files and rename them to obscure the content.

Move the data to a public cloud storage service with a shared link.

Encrypt the drive and share the password with all team members.

A CTI team is tasked with tracking a specific threat actor group that uses new malware families and infrastructure. The team has limited resources and must choose which sources to collect from. Which approach best aligns with the collection requirement?

Collect from all available sources to maximize coverage, regardless of relevance.

Wait for the threat actor to be publicly disclosed before starting collection.

Only collect from internal network logs because they are most trusted.

Focus on sources known to report on the threat actor, such as industry ISACs, sandbox reports, and dark web monitoring.

A healthcare organization collects threat intelligence that includes patient data. Legal counsel advises that certain data must be retained for 6 years, but the organization's security team wants to delete data as soon as possible to reduce risk. The organization also faces a lawsuit that requires preservation of relevant data. What is the best course of action?

Delete all data immediately to minimize security risk, ignoring the legal hold.

Retain all data for 6 years, then delete everything.

Encrypt all data and retain it indefinitely to avoid any legal issues.

Implement a retention policy that distinguishes between data types, applies the 6-year retention where required, and suspends deletion for data under legal hold.

GIAC Cyber Threat Intelligence

Domain 2Objective 1

Collecting and Storing Data Sets GCTI Practice Questions (Page 1)

Part of the Intelligence Collection and Storage domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 8–14 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 1–5

1application · medium
A threat intelligence team receives indicators of compromise (IOCs) from multiple sources in different formats: STIX, CSV, and plain text. The team needs to correlate these IOCs with internal logs. What should the team do first to enable effective correlation?
Select an answer first
2application · medium
A threat intelligence team stores sensitive data about ongoing investigations in a shared network drive. The team wants to ensure that only analysts with a specific clearance level can access the data, and that access is logged. What should the team implement?
Select an answer first
3foundation · easy
To protect stored threat intelligence from unauthorized disclosure, which control is most directly applied?
Select an answer first
4application · medium
A CTI team is tasked with tracking a specific threat actor group that uses new malware families and infrastructure. The team has limited resources and must choose which sources to collect from. Which approach best aligns with the collection requirement?
Select an answer first
5expert · hard
A healthcare organization collects threat intelligence that includes patient data. Legal counsel advises that certain data must be retained for 6 years, but the organization's security team wants to delete data as soon as possible to reduce risk. The organization also faces a lawsuit that requires preservation of relevant data. What is the best course of action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Collecting and Storing Data Sets GCTI Practice Questions (Page 1)

Questions 1–5

A threat intelligence team receives indicators of compromise (IOCs) from multiple sources in different formats: STIX, CSV, and plain text. The team needs to correlate these IOCs with internal logs. What should the team do first to enable effective correlation?

A threat intelligence team stores sensitive data about ongoing investigations in a shared network drive. The team wants to ensure that only analysts with a specific clearance level can access the data, and that access is logged. What should the team implement?

To protect stored threat intelligence from unauthorized disclosure, which control is most directly applied?

A CTI team is tasked with tracking a specific threat actor group that uses new malware families and infrastructure. The team has limited resources and must choose which sources to collect from. Which approach best aligns with the collection requirement?

Keep studying — Intelligence Collection and Storage