Intelligence Application GCTI Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company's risk management team is deciding whether to invest in additional endpoint detection and response (EDR) capabilities. The threat intelligence team has produced a report showing that the company's industry is being targeted by a specific adversary using fileless attacks. Which use of the intelligence best supports the risk management decision?

   • AAdd the adversary's known IOCs to the existing firewall rules and consider the risk mitigated.
   • BWait for a confirmed breach before making any security investments.
   • CUse the report to justify the EDR investment by correlating the adversary's TTPs with the current security gaps.
   • DForward the report to the IT department and ask them to implement all recommended mitigations immediately.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   After deploying new detection rules based on CTI, the SOC notices a high number of false positives. The CTI team wants to refine the intelligence cycle. Which action best uses this feedback?

   • AIncrease the severity of the alerts so the SOC pays more attention to them.
   • BAnalyze the false positives to identify gaps in the intelligence and adjust the detection rules and intelligence requirements accordingly.
   • CDisable the detection rules and stop using CTI for detection until the false positives are resolved.
   • DIgnore the false positives because they are a normal part of detection.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A threat intelligence team is preparing to disseminate a report on a new malware strain that is targeting the company's industry. The report contains sensitive information about the company's own vulnerabilities that were exploited in a recent attack. The team must share the report with internal stakeholders, but is concerned about the information being leaked. Which dissemination method best balances the need for information sharing with the risk of leakage?

   • AShare the report only with the executive team and the security team, and require them to sign a non-disclosure agreement.
   • BProvide a redacted version of the report to all relevant stakeholders, with sensitive details about the company's vulnerabilities removed, and share the full report only with the security team.
   • CSend the full report to all employees to ensure everyone is aware of the threat.
   • DDo not share the report internally and only use it to inform the security team's actions.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization's CTI team has identified a new adversary targeting their industry. The team must integrate this intelligence into the organization's risk management framework, but the risk team is concerned about the reliability of the intelligence. Which approach best addresses the risk team's concern while still applying the intelligence?

   • AInclude the intelligence in the risk assessment with a confidence level and recommend compensating controls that are effective even if the threat is uncertain.
   • BAsk the risk team to accept the intelligence without question.
   • CPresent the intelligence as a certainty to convince the risk team to act.
   • DExclude the intelligence from the risk assessment until it is fully verified.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an example of using feedback to refine the intelligence cycle?

   • AAn analyst decides to stop using external intelligence sources because they are expensive
   • BAn analyst deletes old intelligence reports to free up storage space
   • CAn analyst changes the classification level of a report without consulting consumers
   • DAn analyst updates the collection requirements after learning that consumers need more indicators related to a specific threat actor
   Reveal Solution Discussion Select an answer first