Intelligence Application GCTI Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A threat intelligence team has been producing reports for the security operations center (SOC) and the executive team. The SOC has provided feedback that the reports are too focused on strategic threats and not enough on tactical indicators. The executive team has provided feedback that the reports are too technical and not enough on business risk. Which action best addresses the feedback from both stakeholders?

   • AProduce two separate reports: one tactical report for the SOC and one strategic report for the executive team.
   • BFocus on the SOC's feedback and produce a more tactical report, since the SOC is the primary consumer.
   • CProduce a single report that includes both tactical indicators and business risk, and send it to both stakeholders.
   • DFocus on the executive team's feedback and produce a more strategic report, since they control the budget.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A CTI team identifies a new phishing campaign targeting the organization's finance department. The team wants to integrate this intelligence into the security operations center's daily workflow. Which action best achieves this integration?

   • AEmail the finance department a warning and ask them to be cautious with emails.
   • BCreate a new report and post it on the CTI team's internal website.
   • CAdd the campaign's indicators and TTPs to the SIEM and update the SOC's playbooks to include specific response actions.
   • DWait for the campaign to end before taking any action.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the role of threat intelligence in threat hunting?

   • ATo provide hypotheses and indicators that guide proactive searches for malicious activity
   • BTo replace the need for log analysis and endpoint monitoring
   • CTo automatically detect all threats without requiring human analysis
   • DTo provide a list of all vulnerabilities in the organization's systems
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A threat intelligence team is preparing to disseminate a report on a new phishing campaign that is targeting the company's employees. The report includes the phishing email template, the indicators of compromise (IOCs), and recommended actions. The team must decide how to share the report with employees and the security team. Which dissemination approach best ensures that employees can recognize the phishing emails while also enabling the security team to detect and respond to the campaign?

   • ASend the full report only to the security team and do not inform employees, to avoid panic.
   • BSend a simplified alert to all employees describing the phishing email and what to do, and send the full report with IOCs to the security team.
   • CSend the full report to all employees and the security team, but do not include the IOCs to avoid overwhelming employees.
   • DSend the full report to all employees, including the IOCs and recommended actions.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An organization's incident response team is responding to a ransomware outbreak. Threat intelligence indicates that the ransomware uses a specific command-and-control (C2) domain and has a known encryption routine. Which action best applies the intelligence to guide the response?

   • AImmediately shut down all affected systems and begin restoring from backups without further analysis.
   • BWait for the antivirus vendor to provide a decryption tool before taking any action.
   • CBlock the C2 domain at the firewall and use the encryption routine details to determine if any files can be recovered without paying the ransom.
   • DPay the ransom immediately to minimize downtime, as the intelligence indicates the encryption is strong.
   Reveal Solution Discussion Select an answer first