Intelligence Application GCTI Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A CTI team has just completed a comprehensive report on a ransomware group's TTPs. The team wants to ensure the intelligence is applied effectively across the organization. Which action best fulfills the purpose of intelligence application?

   • ATranslate the report into specific detection rules, mitigation guidance, and awareness briefings for the relevant teams.
   • BUse the report to update the organization's risk register but take no further action.
   • CSend the full report to every employee in the organization.
   • DArchive the report in the CTI repository and share it only upon request.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following best describes how intelligence is integrated into security operations?

   • ABy limiting security operations to only act on intelligence from external sources
   • BBy automating all security decisions based on intelligence without human review
   • CBy using intelligence to prioritize alerts and guide investigation efforts
   • DBy replacing the need for security monitoring tools with intelligence feeds
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A CTI team must disseminate a time-sensitive warning about an active exploitation campaign to multiple stakeholders, including executives, SOC analysts, and system administrators. The warning contains sensitive details about a zero-day vulnerability. Which dissemination strategy best balances timeliness, actionability, and security?

   • ASend a brief, sanitized alert to all stakeholders with immediate actions, and follow up with a detailed technical report for the SOC and system administrators.
   • BSend the full detailed report to all stakeholders, including executives, to ensure everyone has complete information.
   • CPost the full report on the company intranet and rely on stakeholders to find it.
   • DWait for the full report to be completed before sending any information to stakeholders.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A CTI team's quarterly intelligence report is consistently rated as 'not actionable' by the SOC and 'too technical' by the executive team. The CTI lead must redesign the reporting process. Which change best addresses the feedback from both audiences?

   • AProduce a single report that is a compromise between technical detail and business language.
   • BEstablish separate reporting channels: a technical brief with IOCs and TTPs for the SOC, and a strategic summary with business impact for executives, each with its own feedback loop.
   • CAsk the SOC and executives to adapt to the current report format.
   • DReduce the frequency of reports to quarterly and make them longer and more detailed.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why is the intelligence application phase considered a critical part of the cyber threat intelligence lifecycle?

   • AIt transforms raw indicators into structured threat intelligence
   • BIt ensures that intelligence is stored securely and retained for future use
   • CIt translates intelligence into actionable decisions and security improvements
   • DIt validates the accuracy of intelligence through peer review
   Reveal Solution Discussion Select an answer first