Intelligence Application GCTI Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An organization's CTI team has intelligence that a specific threat actor is targeting their industry with a new phishing technique. The security team must decide how to integrate this intelligence into their security operations. The team has limited resources and must choose between updating the SIEM with IOCs or training the SOC on the new technique. Which approach is most effective?

   • AUpdate the SIEM with IOCs for immediate detection and provide a brief training session to the SOC on the phishing technique.
   • BOnly update the SIEM with IOCs, since training takes time and resources.
   • COnly train the SOC on the technique, since IOCs are often bypassed.
   • DWait for the threat actor to be observed in the environment before taking action.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A CTI team must disseminate a threat report to stakeholders in different time zones and with different security clearances. The report contains both unclassified and sensitive information. The team wants to ensure that all stakeholders receive the information they need in a timely manner. Which dissemination strategy best meets these requirements?

   • AEmail the full report to all stakeholders and rely on their email security to protect it.
   • BPost the full report on a public website and send the link to all stakeholders.
   • CPublish a sanitized version to a secure portal accessible to all stakeholders, and send a direct notification with a link to the relevant section for each group.
   • DSend the full report only to stakeholders in the same time zone as the CTI team.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   During an incident, the CTI team provides intelligence that the adversary is using a previously unknown malware family. The IR team must decide whether to contain the affected systems immediately or to continue monitoring to gather more intelligence. The organization's leadership wants to minimize business disruption. Which decision best balances the need for containment with the need for intelligence?

   • AContinue monitoring without containment to gather as much intelligence as possible.
   • BAsk the CTI team to provide a full analysis of the malware before making any decision.
   • CContain the systems and stop all data collection to avoid any risk of alerting the adversary.
   • DContain the affected systems to prevent further spread, while using network and host telemetry to collect intelligence on the malware's behavior.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During a threat hunting exercise, an analyst uses intelligence about a specific adversary group that is known to use living-off-the-land binaries (LOLBins) to evade detection. Which hunting technique best applies this intelligence?

   • ASearch for the presence of common LOLBins in the environment, such as powershell.exe or cmd.exe.
   • BBlock all LOLBins from executing on endpoints to prevent the adversary from using them.
   • CLook for unusual command-line arguments or parent-child process relationships involving LOLBins that match the adversary's known patterns.
   • DReview the threat intelligence report for IOCs and add them to the SIEM, but do not perform any proactive hunting.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How does threat intelligence guide incident response activities?

   • ABy providing a legal framework for prosecuting attackers
   • BBy automatically resolving incidents without human intervention
   • CBy eliminating the need for forensic analysis during an incident
   • DBy providing indicators of compromise that help identify affected systems and scope the incident
   Reveal Solution Discussion Select an answer first