During a security incident, the incident response (IR) team identifies indicators of compromise (IOCs) that match a threat actor known to use living-off-the-land binaries (LOLBins). The CTI team has a report detailing the actor's tactics, techniques, and procedures (TTPs). Which action best applies the intelligence to guide the response?

Focus only on eradicating the malware from the initially identified host and then close the incident.

Wait for the CTI team to produce a new report before taking any additional action.

Use the TTPs from the CTI report to proactively hunt for additional compromised hosts and adjust containment measures to block the actor's known methods.

Block all LOLBins across the enterprise to prevent the actor from using them again.

After a major security incident, the threat intelligence team distributed a report that predicted the adversary's likely next steps. The incident response team later reported that the prediction was accurate but the report lacked specific IOCs that would have helped earlier detection. Which action best demonstrates the use of feedback to improve the intelligence cycle?

Ask the IR team to provide a list of IOCs they would have liked, but do not change the reporting template.

Update the intelligence requirements to emphasize the need for more granular technical indicators in future reports.

Share the report with external partners to get their feedback on the IOCs.

Discontinue producing predictive reports because they are not useful without IOCs.

Which of the following is a best practice for disseminating cyber threat intelligence to stakeholders?

Tailor the format and detail of intelligence products to the needs of each audience

Use a single, fixed format for all intelligence products to ensure consistency

Provide the same detailed technical report to all stakeholders regardless of role

Disseminate intelligence only on a need-to-know basis to minimize exposure

GIAC Cyber Threat Intelligence

Domain 3Objective 2

Intelligence Application GCTI Practice Questions (Page 9)

Part of the Intelligence Analysis and Application domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 9–15 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 41–43

41application · medium
During a security incident, the incident response (IR) team identifies indicators of compromise (IOCs) that match a threat actor known to use living-off-the-land binaries (LOLBins). The CTI team has a report detailing the actor's tactics, techniques, and procedures (TTPs). Which action best applies the intelligence to guide the response?
Select an answer first
42application · medium
After a major security incident, the threat intelligence team distributed a report that predicted the adversary's likely next steps. The incident response team later reported that the prediction was accurate but the report lacked specific IOCs that would have helped earlier detection. Which action best demonstrates the use of feedback to improve the intelligence cycle?
Select an answer first
43foundation · easy
Which of the following is a best practice for disseminating cyber threat intelligence to stakeholders?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Intelligence Application GCTI Practice Questions (Page 9)

Questions 41–43

Which of the following is a best practice for disseminating cyber threat intelligence to stakeholders?

Keep studying — Intelligence Analysis and Application