A CTI team is designing a process for handling threat intelligence data from collection to disposal. The team must ensure that data is not kept longer than necessary, that access is logged, and that data is securely destroyed when no longer needed. Which framework should the team adopt?

A real-time streaming pipeline that processes data and immediately discards it after analysis.

A manual review process where analysts decide on a case-by-case basis whether to keep or delete data.

A backup strategy that keeps multiple copies of all data indefinitely.

A data lifecycle management policy that defines stages from collection through storage, usage, archival, and secure deletion.

A threat intelligence team collects indicators from an open-source feed that occasionally contains false positives. The team uses these indicators to block malicious traffic. What should the team do to maintain the accuracy of the dataset?

Implement a validation process that cross-checks indicators against other sources and removes those that cannot be confirmed.

Trust the feed because it is from a reputable source.

Use the indicators immediately to block traffic and review them monthly.

Store all indicators in a separate database and never delete any to preserve history.

A threat intelligence team has a limited budget and must collect data on a new ransomware campaign. The team has access to internal logs, a commercial threat feed, and open-source intelligence. The team needs to produce a report in 48 hours. Which collection strategy best balances timeliness, cost, and data quality?

Collect from all three sources, prioritize the most relevant data, and validate the indicators against internal logs.

Wait for the commercial feed to provide a complete dataset before starting analysis.

Collect only from open-source intelligence to minimize cost.

Use only the commercial feed because it is the most comprehensive and reliable.

GIAC Cyber Threat Intelligence

Domain 2Objective 1

Collecting and Storing Data Sets GCTI Practice Questions (Page 3)

Part of the Intelligence Collection and Storage domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 8–14 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 11–15

11application · medium
A CTI team is designing a process for handling threat intelligence data from collection to disposal. The team must ensure that data is not kept longer than necessary, that access is logged, and that data is securely destroyed when no longer needed. Which framework should the team adopt?
Select an answer first
12application · medium
A threat intelligence team collects indicators from an open-source feed that occasionally contains false positives. The team uses these indicators to block malicious traffic. What should the team do to maintain the accuracy of the dataset?
Select an answer first
13foundation · easy
A threat intelligence platform must store growing volumes of indicators and reports while maintaining fast retrieval for analysts. Which storage architecture feature directly addresses this need?
Select an answer first
14expert · hard
A threat intelligence team has a limited budget and must collect data on a new ransomware campaign. The team has access to internal logs, a commercial threat feed, and open-source intelligence. The team needs to produce a report in 48 hours. Which collection strategy best balances timeliness, cost, and data quality?
Select an answer first
15foundation · easy
When designing a storage architecture for threat intelligence datasets, which characteristic is most important to ensure that data remains unaltered and trustworthy over time?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Collecting and Storing Data Sets GCTI Practice Questions (Page 3)

Questions 11–15

A CTI team is designing a process for handling threat intelligence data from collection to disposal. The team must ensure that data is not kept longer than necessary, that access is logged, and that data is securely destroyed when no longer needed. Which framework should the team adopt?

A threat intelligence team collects indicators from an open-source feed that occasionally contains false positives. The team uses these indicators to block malicious traffic. What should the team do to maintain the accuracy of the dataset?

A threat intelligence platform must store growing volumes of indicators and reports while maintaining fast retrieval for analysts. Which storage architecture feature directly addresses this need?

When designing a storage architecture for threat intelligence datasets, which characteristic is most important to ensure that data remains unaltered and trustworthy over time?

Keep studying — Intelligence Collection and Storage