A threat intelligence team is building a daily feed of indicators from a mix of open-source malware sandboxes, internal DNS logs, and a commercial threat feed. The team needs to correlate these sources to identify overlapping malicious domains. The data arrives in different formats: JSON, CSV, and proprietary XML. Which approach should the team take to enable consistent correlation?

Use the commercial feed's format as the standard and require all other sources to export in that exact format.

Load all raw data into a single data lake and rely on the analytics platform to infer relationships without any transformation.

Store each source in its native format and write a separate correlation script for each pair of sources.

Convert all indicators into a standardized format, such as STIX, before storing them in the central intelligence repository.

A threat intelligence team is establishing a retention policy for different types of data. The team wants to ensure that data is kept long enough for historical analysis but not longer than necessary. What is the best way to determine retention periods?

Use a single retention period for all data to simplify management.

Delete data as soon as it is no longer actively used.

Retain all data indefinitely to support future analysis.

Set retention periods based on the data type, legal requirements, and operational value, and review them periodically.

A CTI team shares intelligence with partner organizations. The team wants to ensure that partners can access only the specific indicators they are authorized to see, while also preventing unauthorized internal access. The team uses a cloud-based repository. Which access control approach is most appropriate?

Use federated identity management and attribute-based access control to grant partners access only to authorized indicators.

Create a shared account for all partners with read-only access to the entire repository.

Email the indicators to partners on request instead of providing direct access.

Grant all partners full access to the repository to encourage collaboration.

A CTI team has a dataset of malware hashes and wants to add information about the malware family, associated campaigns, and MITRE ATT&CK techniques. The team has access to a malware analysis platform that provides this context. What should the team do?

Create a separate spreadsheet that maps hashes to context and share it with analysts.

Enrich the hash records with the contextual data and store the enriched records in the central repository.

Replace the hash dataset with the contextual information only.

Store the contextual information in a separate database and link them manually during analysis.

A threat intelligence team has collected IP addresses associated with a botnet. To enhance the intelligence value, the team wants to add geolocation and ownership information to each IP address. What is the best way to achieve this?

Discard the IP addresses because they are not useful without context.

Use an automated enrichment tool that queries external databases and appends the contextual data to the existing records.

Manually look up each IP address and add the information to a spreadsheet.

Store the IP addresses in a separate database and keep the context in another.

GIAC Cyber Threat Intelligence

Domain 2Objective 1

Collecting and Storing Data Sets GCTI Practice Questions (Page 7)

Part of the Intelligence Collection and Storage domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 8–14 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 31–35

31application · medium
A threat intelligence team is building a daily feed of indicators from a mix of open-source malware sandboxes, internal DNS logs, and a commercial threat feed. The team needs to correlate these sources to identify overlapping malicious domains. The data arrives in different formats: JSON, CSV, and proprietary XML. Which approach should the team take to enable consistent correlation?
Select an answer first
32application · medium
A threat intelligence team is establishing a retention policy for different types of data. The team wants to ensure that data is kept long enough for historical analysis but not longer than necessary. What is the best way to determine retention periods?
Select an answer first
33expert · hard
A CTI team shares intelligence with partner organizations. The team wants to ensure that partners can access only the specific indicators they are authorized to see, while also preventing unauthorized internal access. The team uses a cloud-based repository. Which access control approach is most appropriate?
Select an answer first
34application · medium
A CTI team has a dataset of malware hashes and wants to add information about the malware family, associated campaigns, and MITRE ATT&CK techniques. The team has access to a malware analysis platform that provides this context. What should the team do?
Select an answer first
35application · medium
A threat intelligence team has collected IP addresses associated with a botnet. To enhance the intelligence value, the team wants to add geolocation and ownership information to each IP address. What is the best way to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Collecting and Storing Data Sets GCTI Practice Questions (Page 7)

Questions 31–35

A threat intelligence team is establishing a retention policy for different types of data. The team wants to ensure that data is kept long enough for historical analysis but not longer than necessary. What is the best way to determine retention periods?

A CTI team has a dataset of malware hashes and wants to add information about the malware family, associated campaigns, and MITRE ATT&CK techniques. The team has access to a malware analysis platform that provides this context. What should the team do?

A threat intelligence team has collected IP addresses associated with a botnet. To enhance the intelligence value, the team wants to add geolocation and ownership information to each IP address. What is the best way to achieve this?

Keep studying — Intelligence Collection and Storage