Intelligence Fundamentals GCTI Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational corporation is evaluating whether to build an in-house threat intelligence team or outsource to a commercial provider. The corporation has a mature security operations center but lacks experience in intelligence analysis. The CISO wants to improve the organization's ability to anticipate and respond to targeted attacks. Which approach best balances cost, capability, and control?

   • ABuild an in-house team from scratch to maintain full control over intelligence priorities
   • BUse a hybrid model: subscribe to a commercial feed for baseline intelligence and build a small in-house team for analysis and tailored reporting
   • CFully outsource all intelligence functions to a commercial provider to gain immediate expertise
   • DRely solely on free open-source intelligence to avoid costs
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An intelligence analyst is investigating a sophisticated threat actor that has evaded detection for months. The analyst has access to open-source intelligence (OSINT), a commercial threat feed, and internal network logs. The actor's tactics, techniques, and procedures (TTPs) are not well-documented in any single source. What is the most effective approach to develop a comprehensive profile of the actor?

   • ACorrelate internal network logs with OSINT and the commercial feed to identify patterns and fill gaps
   • BRely on the commercial threat feed, as it is the most authoritative source
   • CWait for more information to become available before starting the analysis
   • DFocus only on OSINT, as it is the most up-to-date source
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A CTI team has collected thousands of raw logs from firewall, endpoint, and DNS servers after a suspected intrusion. The team needs to produce a report for the CISO that explains the attack chain and recommends mitigation steps. The raw logs contain timestamps, IP addresses, and process names but are noisy and incomplete. Which step should the team perform FIRST to transform this data into a usable intelligence product?

   • ACorrelate the logs to reconstruct the sequence of events and identify the key indicators of compromise.
   • BSend the raw logs to an external threat intelligence vendor for analysis without any internal processing.
   • CWrite the final report immediately, using the raw logs as an appendix for the CISO to interpret.
   • DDelete logs that appear incomplete to reduce noise and focus only on the most complete data sets.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of a well-articulated intelligence requirement?

   • AMonitor all social media for any mention of our company
   • BCollect all information about ransomware groups
   • CWhat are the most common initial access vectors used by ransomware groups targeting our industry?
   • DIdentify all vulnerabilities in our network
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A CTI team produces a weekly threat summary for the executive team. The summary includes technical details about malware families and indicators of compromise. The executives have expressed that the report is too detailed and they only need to know the potential business impact and recommended actions. Which change should the team make to improve the dissemination of intelligence?

   • AStop sending reports to the executive team and only send them to the SOC.
   • BContinue sending the same report but add a disclaimer that executives should focus on the first page.
   • CAsk the executives to attend a training session on technical terms so they can understand the report.
   • DCreate a separate executive summary that focuses on business risk, impact, and high-level recommendations, while keeping the technical details in a separate report for the SOC.
   Reveal Solution Discussion Select an answer first