A CTI team ingests a large number of indicators from an automated feed. The team discovers that some indicators are outdated (e.g., IP addresses that are no longer malicious) and some are incorrectly formatted. What is the best way to maintain the quality of the indicator database?

Manually review every indicator before storing it.

Keep all indicators indefinitely to avoid losing potentially useful data.

Only rely on the feed's built-in quality checks and do not perform additional validation.

Periodically validate indicators against trusted sources and remove or update those that are no longer valid.

A CTI team collects a list of malicious IP addresses from a sandbox feed. The team wants to add geolocation, ASN ownership, and historical WHOIS data to each IP to help prioritize incidents. Which process should the team use?

Convert the IP list to STIX and store it without any additional data.

Delete the IP list because it lacks context.

Store the IP list as-is and manually look up each IP when an incident occurs.

Enrich the IP indicators with contextual data from external sources and store the enriched records in the intelligence repository.

What is the goal of data quality management in a threat intelligence dataset?

To maximize the number of indicators collected

To ensure data is accurate, complete, and reliable

GIAC Cyber Threat Intelligence

Domain 2Objective 1

Collecting and Storing Data Sets GCTI Practice Questions (Page 8)

Part of the Intelligence Collection and Storage domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 8–14 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 36–40

36foundation · easy
An analyst combines threat data from internal logs with external OSINT feeds and adds context such as the threat actor's motivation. What is this process called?
Select an answer first
37application · medium
A CTI team ingests a large number of indicators from an automated feed. The team discovers that some indicators are outdated (e.g., IP addresses that are no longer malicious) and some are incorrectly formatted. What is the best way to maintain the quality of the indicator database?
Select an answer first
38foundation · easy
In data lifecycle management, what is the final stage of data handling for data that is no longer needed?
Select an answer first
39application · medium
A CTI team collects a list of malicious IP addresses from a sandbox feed. The team wants to add geolocation, ASN ownership, and historical WHOIS data to each IP to help prioritize incidents. Which process should the team use?
Select an answer first
40foundation · easy
What is the goal of data quality management in a threat intelligence dataset?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Collecting and Storing Data Sets GCTI Practice Questions (Page 8)

Questions 36–40

An analyst combines threat data from internal logs with external OSINT feeds and adds context such as the threat actor's motivation. What is this process called?

A CTI team ingests a large number of indicators from an automated feed. The team discovers that some indicators are outdated (e.g., IP addresses that are no longer malicious) and some are incorrectly formatted. What is the best way to maintain the quality of the indicator database?

In data lifecycle management, what is the final stage of data handling for data that is no longer needed?

A CTI team collects a list of malicious IP addresses from a sandbox feed. The team wants to add geolocation, ASN ownership, and historical WHOIS data to each IP to help prioritize incidents. Which process should the team use?

What is the goal of data quality management in a threat intelligence dataset?

Keep studying — Intelligence Collection and Storage