Intelligence Application GCTI Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A multinational company has a security team that produces threat intelligence for both its internal SOC and its customers. The team has limited resources and must decide how to allocate effort between producing a detailed report on a new adversary group targeting the company's sector and updating existing detection rules for a previously identified group that is still active. The SOC has reported that the existing rules are generating a high number of false positives. Which decision best balances the competing needs?

   • AProduce a brief summary of the new adversary and send it to the SOC, but do not update the existing rules.
   • BPostpone the new report and focus on refining the existing rules to reduce false positives, then produce the new report in the next cycle.
   • CFocus all resources on the new adversary report, as it addresses a novel threat that may not be covered by existing defenses.
   • DAllocate a small portion of time to update the existing rules and dedicate the majority of effort to the new report.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A threat intelligence team is preparing to disseminate a report on a zero-day vulnerability affecting a widely used VPN product. The report includes technical details, exploit code, and recommended mitigations. The team must decide how to share this information with different stakeholders, including the vendor, customers, and the public. Which dissemination strategy best balances responsible disclosure and stakeholder needs?

   • APublish the full report, including exploit code, on a public blog immediately to warn the community.
   • BKeep the report internal and do not share it with anyone until a patch is available.
   • CSend the full report to all customers immediately, including exploit code, so they can assess their risk.
   • DShare the report with the vendor first and provide a redacted version to customers, withholding exploit code until a patch is available.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   After a major incident, the CTI team reviews the intelligence products they produced during the event. The SOC analysts report that the daily threat briefs were too generic and did not include the specific IOCs they needed for detection. The CTI lead wants to improve future intelligence products. Which action best incorporates this feedback?

   • ARevise the intelligence requirements to include more specific IOC details and adjust the dissemination format to better meet SOC needs.
   • BStop producing daily briefs and only issue reports after major incidents.
   • CIncrease the length of the daily briefs to include all available intelligence, regardless of relevance.
   • DAsk the SOC to work with the generic briefs and provide more detailed feedback at the next quarterly review.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   During incident response, the CTI team provides intelligence that a threat actor typically exfiltrates data via encrypted DNS tunnels. The IR team is unsure how to use this information. Which action best applies the intelligence to the response?

   • ABlock all DNS traffic to prevent any possible exfiltration.
   • BAsk the CTI team for a new report before taking any action.
   • CInspect DNS logs for anomalous queries and add detection for encrypted DNS tunneling to the monitoring tools.
   • DFocus only on the initially compromised host and ignore the possibility of data exfiltration.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A threat intelligence team has been producing monthly reports for the executive team. After several months, the executives indicate that the reports are too technical and do not clearly communicate business risk. Which action best addresses this feedback?

   • AStop producing reports for the executive team and only share intelligence with the security team.
   • BAsk the executives to attend a technical training session so they can better understand the reports.
   • CRevise the report format to include a non-technical executive summary that highlights business impact, risk, and recommended actions.
   • DContinue producing the same reports because the executives will eventually understand the technical details.
   Reveal Solution Discussion Select an answer first