Intelligence Fundamentals GCTI Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A large organization is planning its annual threat intelligence priorities. The security team has limited resources and must focus on the most critical threats. The organization's main business is online retail, and it has seen an increase in credential stuffing attacks. Which intelligence requirement should be the top priority?

   • ACollect intelligence on all cyber threats worldwide to ensure comprehensive coverage
   • BTrack threat actors known to conduct credential stuffing attacks against online retail platforms
   • CIdentify the most common malware families used in targeted attacks against financial institutions
   • DMonitor for new vulnerabilities in the organization's web application framework
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of the dissemination stage in the intelligence cycle?

   • ATo store intelligence products in a secure database
   • BTo evaluate the performance of intelligence analysts
   • CTo deliver finished intelligence to the stakeholders who need it in a timely and usable format
   • DTo collect new data from external sources
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which analytical technique is commonly used to identify relationships between entities such as IP addresses, domains, and malware samples?

   • ASWOT analysis
   • BLink analysis
   • CStatistical regression
   • DRoot cause analysis
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst is collecting intelligence on a new exploit kit that is being sold on underground forums. The analyst has found a sample of the exploit kit and has also seen a post from the seller describing its features. The analyst wants to verify the seller's claims about the exploit kit's capabilities. Which source would provide the MOST objective verification?

   • AThe seller's post on the underground forum that describes the exploit kit's features.
   • BA news article that mentions the exploit kit and its impact on recent victims.
   • CThe analyst's own assumptions based on the exploit kit's name and the seller's reputation.
   • DA technical analysis from an independent security researcher who has reverse-engineered the exploit kit.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A CTI team has just delivered a finished intelligence report on a new malware family to the security operations center (SOC). The SOC manager provides feedback that the report was too technical and did not clearly state which systems were at risk or what actions to take. The CTI team is about to start the next intelligence cycle. How should the team incorporate this feedback?

   • AReduce the frequency of reports to give the SOC more time to analyze them.
   • BUpdate the intelligence requirements to include the need for actionable mitigation steps and clear risk statements for technical audiences.
   • CIgnore the feedback because the report was technically accurate and the SOC should be able to interpret it.
   • DSend the SOC manager a glossary of technical terms so they can better understand future reports.
   Reveal Solution Discussion Select an answer first