Intelligence Application GCTI Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational organization's CTI team produces a threat report on a sophisticated adversary. The report includes sensitive source information that cannot be shared broadly, but the organization's regional security teams need actionable indicators. The CTI lead must balance the need for timely dissemination with the protection of sources. Which approach best satisfies both requirements?

   • AIssue a sanitized report with indicators and mitigations to regional teams, while keeping source details restricted to the CTI team and executive leadership.
   • BPublish the full report on the internal wiki with a warning label.
   • CShare the full report only with regional security leads and require them to sign an NDA.
   • DDelay dissemination until all source details can be cleared for release to all personnel.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A CTI team has intelligence that a threat actor is likely to use a specific remote access tool (RAT) in the next campaign. The organization's security team is considering whether to block the RAT's known domains or to focus on detecting the RAT's behavior. The team has limited resources and must choose a strategy. Which approach is most effective given the intelligence?

   • APrioritize behavioral detection of the RAT's command-and-control communication patterns, while also blocking known domains as a quick win.
   • BWait for the campaign to begin before implementing any detection or blocking.
   • CBlock only the known domains and consider the threat mitigated.
   • DFocus exclusively on hunting for the RAT's file hash across the environment.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A CTI team receives feedback that their weekly threat briefs are too long and not read by the SOC. The SOC prefers a short, actionable summary with IOCs. However, the executive team wants a monthly strategic report. The CTI lead must redesign the dissemination process with limited resources. Which approach best addresses the feedback while using resources efficiently?

   • ACreate a concise weekly technical brief for the SOC and a separate monthly strategic report for executives, reusing content where possible.
   • BProduce one weekly report that includes both technical IOCs and strategic analysis.
   • CSend the same monthly strategic report to both the SOC and executives.
   • DEliminate the weekly brief and only produce the monthly strategic report.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A cyber threat intelligence team has produced a detailed report on a new ransomware family that targets backup systems. The report includes technical indicators, MITRE ATT&CK mappings, and recommended mitigations. Which dissemination approach best ensures the report is actionable for both technical and non-technical stakeholders?

   • APublish the full report on the internal wiki and send a link to the security team only.
   • BEmail the full report to the entire organization, including executives, IT staff, and all employees.
   • CHold a single all-hands meeting to verbally present the entire report to everyone at once.
   • DProvide a one-page executive summary to leadership, a technical brief to IT and security teams, and a short awareness notice to all employees.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A threat intelligence team has been providing weekly reports to the security operations center (SOC). The SOC has provided feedback that the reports are often too late to be actionable, and that the team would prefer real-time alerts for critical indicators. The intelligence team has limited automation capabilities. Which action best addresses the feedback while considering the team's constraints?

   • AInvest in a commercial threat intelligence platform that can automate alerting, even if it exceeds the current budget.
   • BAsk the SOC to wait for the weekly reports and adjust their processes to work with the current schedule.
   • CImplement a manual process to send email alerts for critical indicators as soon as they are identified, even if it requires extra effort.
   • DContinue the weekly reports but add a section that summarizes the most critical indicators for the week.
   Reveal Solution Discussion Select an answer first