Intelligence Application GCTI Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A CTI team has intelligence that a threat actor is likely to use a specific vulnerability in the next wave of attacks. The organization has both a vulnerability management program and an incident response team. The CTI team must decide how to apply the intelligence to both functions. Which approach best coordinates the response?

   • AOnly provide detection guidance to the IR team and delay patching.
   • BWait for the vulnerability to be exploited before taking any action.
   • COnly patch the vulnerability in all systems, regardless of criticality.
   • DPrioritize patching the vulnerability in critical systems and provide the IR team with detection guidance for exploit attempts.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A CTI team produces a threat report that includes sensitive information about a vulnerability in a third-party product used by the organization. The report must be shared with IT administrators who need to apply mitigations, but the full report contains details that should not be widely distributed. What is the best dissemination approach?

   • APost the full report on the company intranet with a note that it is confidential.
   • BShare the full report only with the vendor, and let them decide what to tell the organization.
   • CSend the full report to all employees to ensure everyone is aware of the vulnerability.
   • DProvide IT administrators with a sanitized version containing the vulnerability details and mitigation steps, while keeping the full report restricted to the CTI team and management.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In the cyber threat intelligence lifecycle, what is the primary purpose of the intelligence application phase?

   • ATo deliver intelligence to consumers so they can make informed decisions and take action
   • BTo collect data from external and internal sources
   • CTo convert raw data into finished intelligence products
   • DTo evaluate the reliability of intelligence sources
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a key consideration when disseminating intelligence to a non-technical executive audience?

   • AInclude raw packet captures and malware source code for transparency
   • BProvide a list of all indicators of compromise for their review
   • CFocus on the business impact, risk, and recommended actions
   • DUse technical jargon to demonstrate the depth of the analysis
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A CTI analyst discovers that a known adversary is using a specific command-line tool to enumerate Active Directory. The analyst wants to enable the threat hunting team to detect this activity. Which action best supports intelligence-driven threat hunting?

   • AAdd the tool's hash to a blocklist and inform the hunting team that the threat is mitigated.
   • BPublish the intelligence only on the CTI team's internal wiki and wait for the hunting team to find it.
   • CRecommend that the hunting team focus on network traffic only, since the tool runs locally.
   • DProvide the hunting team with the tool's command-line patterns and associated behavioral indicators to create targeted hunt hypotheses.
   Reveal Solution Discussion Select an answer first