Intelligence Application GCTI Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization's threat intelligence team has identified that a specific adversary group is targeting the financial sector with spear-phishing emails that deliver a remote access trojan (RAT). The organization's incident response (IR) team is currently responding to a malware infection that matches this profile. Which action best integrates the intelligence into the IR process?

   • AIsolate the infected host and wait for the IR team to complete their standard containment procedures.
   • BDelete the malicious email from the user's mailbox and move on, since the infection is already contained.
   • CImmediately block the RAT's command-and-control domain at the firewall and consider the incident closed.
   • DUse the intelligence report to identify additional indicators of compromise (IOCs) and hunt for other affected hosts that may share the same RAT or command-and-control infrastructure.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company's security team is planning to implement a new security information and event management (SIEM) system. The threat intelligence team has a feed of indicators related to the company's industry. Which integration approach best ensures the SIEM provides value to the security operations team?

   • AWait until the SIEM is fully deployed and then decide how to integrate intelligence.
   • BIntegrate the intelligence feed into the SIEM and create correlation rules that prioritize alerts based on the relevance of the intelligence to the company's environment and risk profile.
   • CIngest all available threat intelligence feeds into the SIEM and create alerts for any match.
   • DUse the intelligence feed only for manual lookup during incident investigations, not for automated alerting.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Why is feedback from intelligence consumers important in the intelligence lifecycle?

   • AIt allows the organization to stop producing intelligence that is not used
   • BIt ensures that intelligence is kept confidential and not shared externally
   • CIt provides a legal record of intelligence activities for compliance
   • DIt helps analysts improve the relevance and quality of future intelligence products
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A manufacturing company's CTI team identifies a campaign targeting industrial control systems (ICS) with a new phishing lure. The company's security team wants to integrate this intelligence into their risk management process. Which action best applies the intelligence to risk management?

   • AImmediately disconnect all ICS systems from the network to eliminate the risk.
   • BWait for the vendor to release a patch before taking any action.
   • CSend a general security awareness email to all employees about phishing, without mentioning the ICS-specific campaign.
   • DConduct a risk assessment that incorporates the threat actor's capabilities and intent, and prioritize mitigation controls for ICS assets.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is considering whether to adopt a new security control that would mitigate a specific threat actor's techniques. The threat intelligence team has produced a report indicating that the actor is likely to target the company within the next six months. The company's risk management team is concerned about the cost of the control and its impact on user productivity. Which decision best integrates the intelligence into the risk management process?

   • AAdopt the control immediately because the intelligence indicates a high likelihood of attack.
   • BReject the control because the cost is too high and the threat is not certain.
   • CUse the intelligence to conduct a risk assessment that weighs the likelihood and impact of the threat against the cost and productivity impact of the control, and make a data-driven decision.
   • DAdopt the control on a trial basis for a short period and then decide based on user feedback.
   Reveal Solution Discussion Select an answer first