A CTI team stores sensitive intelligence in a cloud-based repository. The team is concerned about unauthorized access from within the organization and wants to ensure that only specific analysts can view raw data. Which control should the team implement?

Rely on the cloud provider's default security settings without additional configuration.

Grant all employees read access to the repository to encourage collaboration.

Store the data in an encrypted format and share the decryption key with all analysts.

Use attribute-based access control (ABAC) that grants access based on the analyst's role, clearance, and project assignment.

A CTI team is implementing a system to manage intelligence data. The team needs to ensure that data is automatically archived after a certain period, that access is logged, and that data is securely deleted at the end of its life. Which approach should the team take?

Store all data in a single active tier and never delete anything.

Implement automated lifecycle policies that move data to archive storage, log access, and trigger secure deletion based on retention rules.

Manually archive data at the end of each quarter and delete old files when storage runs low.

Use a backup system that retains multiple copies of all data for disaster recovery.

Why is data normalization important for correlating threat indicators from different sources?

It ensures that equivalent indicators are represented in the same way.

It automatically deletes duplicate records.

It encrypts the data to prevent unauthorized access.

It reduces the storage size of the dataset.

A multinational company's CTI team stores intelligence in a central repository that is accessed by analysts in three countries. The team must ensure that only authorized analysts can read raw intelligence, while finished reports can be shared more broadly within the company. Which storage architecture feature is most important to implement?

A public cloud storage bucket with a shared access key distributed to all analysts.

A single shared folder with read-only permissions for all analysts.

A versioned file system that retains all previous versions of every file for compliance.

Encryption at rest and in transit, with role-based access control (RBAC) applied at the data classification level.

GIAC Cyber Threat Intelligence

Domain 2Objective 1

Collecting and Storing Data Sets GCTI Practice Questions (Page 10)

Part of the Intelligence Collection and Storage domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 8–14 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 46–50

46application · medium
A CTI team stores sensitive intelligence in a cloud-based repository. The team is concerned about unauthorized access from within the organization and wants to ensure that only specific analysts can view raw data. Which control should the team implement?
Select an answer first
47application · medium
A CTI team is implementing a system to manage intelligence data. The team needs to ensure that data is automatically archived after a certain period, that access is logged, and that data is securely deleted at the end of its life. Which approach should the team take?
Select an answer first
48foundation · easy
Why is data normalization important for correlating threat indicators from different sources?
Select an answer first
49application · medium
A multinational company's CTI team stores intelligence in a central repository that is accessed by analysts in three countries. The team must ensure that only authorized analysts can read raw intelligence, while finished reports can be shared more broadly within the company. Which storage architecture feature is most important to implement?
Select an answer first
50foundation · easy
During the data collection planning phase, an analyst documents the specific types of adversary behaviors, indicators, and contextual details that the intelligence team needs to support a decision. What is this documentation called?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Collecting and Storing Data Sets GCTI Practice Questions (Page 10)

Questions 46–50

A CTI team stores sensitive intelligence in a cloud-based repository. The team is concerned about unauthorized access from within the organization and wants to ensure that only specific analysts can view raw data. Which control should the team implement?

A CTI team is implementing a system to manage intelligence data. The team needs to ensure that data is automatically archived after a certain period, that access is logged, and that data is securely deleted at the end of its life. Which approach should the team take?

Why is data normalization important for correlating threat indicators from different sources?

During the data collection planning phase, an analyst documents the specific types of adversary behaviors, indicators, and contextual details that the intelligence team needs to support a decision. What is this documentation called?

Keep studying — Intelligence Collection and Storage