A threat intelligence team receives a large number of IOCs in a proprietary format from a partner. The team's analysis platform only supports STIX. What should the team do to make the data usable?

Manually copy the data into the platform's format.

Store the proprietary format in a separate database and query it separately.

Write a parser to convert the proprietary format into STIX and validate the converted data.

Ask the partner to send the data in a different format every time.

A CTI team has a large dataset of IP addresses and domains. The team wants to enrich this data with threat actor attribution and campaign information, but the enrichment source is expensive and has a daily query limit. The team must prioritize which indicators to enrich. What is the best approach?

Skip enrichment and rely on raw indicators for analysis.

Enrich all indicators equally to ensure complete coverage.

Enrich only the most recent indicators and ignore older ones.

Prioritize enrichment for indicators that are associated with active campaigns or high-value targets.

An organization's threat intelligence platform is expanding to store petabytes of raw network flow data. The data is accessed frequently for the first 30 days, then rarely. The team must design a storage architecture that balances cost, accessibility, and security. Which solution best meets these needs?

Use a single storage tier with infrequent access to minimize cost, accepting slower retrieval for all data.

Store all data on high-performance solid-state drives for the entire lifecycle to ensure fast access.

Use a hot storage tier for the first 30 days, then automatically transition to a cold or archive tier, with encryption and access controls applied at all tiers.

Store all data in a cold archive tier and rely on the vendor's retrieval service for any access.

A threat intelligence team is planning to collect data on a newly identified malware family. They have limited storage and need to prioritize sources. The team must ensure that the collected data can be used for future correlation with other datasets. Which approach best aligns with the collection planning and data quality requirements?

Collect only from internal network logs because they are the most reliable source.

Defer collection until a formal data retention policy is written.

Collect all available data from as many sources as possible, then filter later.

Define specific collection requirements based on the intelligence gaps, select sources that directly address those gaps, and validate the data for accuracy and completeness.

What is the primary purpose of a data retention schedule in a threat intelligence program?

To determine which sources are most reliable

To define the format for storing indicators

To specify how long each type of data is kept and when it is disposed of

GIAC Cyber Threat Intelligence

Domain 2Objective 1

Collecting and Storing Data Sets GCTI Practice Questions (Page 4)

Part of the Intelligence Collection and Storage domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 8–14 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 16–20

16application · medium
A threat intelligence team receives a large number of IOCs in a proprietary format from a partner. The team's analysis platform only supports STIX. What should the team do to make the data usable?
Select an answer first
17expert · hard
A CTI team has a large dataset of IP addresses and domains. The team wants to enrich this data with threat actor attribution and campaign information, but the enrichment source is expensive and has a daily query limit. The team must prioritize which indicators to enrich. What is the best approach?
Select an answer first
18application · medium
An organization's threat intelligence platform is expanding to store petabytes of raw network flow data. The data is accessed frequently for the first 30 days, then rarely. The team must design a storage architecture that balances cost, accessibility, and security. Which solution best meets these needs?
Select an answer first
19application · medium
A threat intelligence team is planning to collect data on a newly identified malware family. They have limited storage and need to prioritize sources. The team must ensure that the collected data can be used for future correlation with other datasets. Which approach best aligns with the collection planning and data quality requirements?
Select an answer first
20foundation · easy
What is the primary purpose of a data retention schedule in a threat intelligence program?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Collecting and Storing Data Sets GCTI Practice Questions (Page 4)

Questions 16–20

A threat intelligence team receives a large number of IOCs in a proprietary format from a partner. The team's analysis platform only supports STIX. What should the team do to make the data usable?

A CTI team has a large dataset of IP addresses and domains. The team wants to enrich this data with threat actor attribution and campaign information, but the enrichment source is expensive and has a daily query limit. The team must prioritize which indicators to enrich. What is the best approach?

What is the primary purpose of a data retention schedule in a threat intelligence program?

Keep studying — Intelligence Collection and Storage