A threat intelligence team has produced a report on a new malware campaign. The report is intended for both the executive team and the SOC. The team has limited time and must disseminate the report. What is the best approach?

Create two versions: a high-level executive summary and a detailed technical report for the SOC

Only send the report to the executive team, as they are the primary decision-makers

Send the same detailed report to both audiences to ensure consistency

Only send the report to the SOC, as they are the ones who will act on it

A financial services firm has just experienced a ransomware attack that disrupted trading operations for six hours. The board has approved a new threat intelligence program and wants to ensure that future attacks are detected earlier. The CTI team is defining the first intelligence cycle. Which action should the team take FIRST to ensure the cycle produces actionable results?

Deploy a commercial threat intelligence feed to collect indicators of compromise from multiple sources.

Draft intelligence requirements that specify the types of ransomware, delivery methods, and early-warning indicators the organization needs.

Hire an external threat intelligence vendor to produce a comprehensive report on the ransomware group responsible for the attack.

Create a dissemination plan that lists which executives receive daily threat briefings and which analysts receive technical reports.

A cyber threat intelligence team is tasked with producing a quarterly report for the board of directors. The report must summarize the top threats facing the organization and justify the security budget. The team has collected a large volume of raw data from multiple sources, but the analysts are overwhelmed and the report is due in two weeks. Which step of the intelligence lifecycle should the team prioritize to ensure the report is useful and delivered on time?

Refining the intelligence requirements with the board to focus collection and analysis on their key concerns

Processing and exploitation of the collected data to convert it into a usable format

Increasing collection from additional sources to ensure no threat is missed

Dissemination of the raw data directly to the board so they can see the full picture

A CTI team is establishing a new intelligence capability. The team has limited budget and must choose between two collection strategies: (1) purchasing a commercial threat intelligence feed that provides a high volume of indicators, or (2) building a small internal team that conducts targeted collection based on the organization's specific intelligence requirements. The organization's primary need is to support incident response for a specific set of critical assets. Which strategy is MOST aligned with the intelligence cycle and the organization's need?

Purchase the commercial feed and also build the internal team, but only if the budget allows.

Build the internal team because it can focus collection on the organization's intelligence requirements and produce tailored analysis.

Purchase the commercial feed because it provides a large volume of indicators that can be used immediately.

Use open-source intelligence only, because it is free and can provide enough information for incident response.

A threat intelligence team is tasked with supporting a new product launch. The product team is concerned about intellectual property theft. The security team has limited collection resources. Which intelligence requirement is most appropriate to guide collection?

Identify threat actors or groups that have previously targeted similar products or industries

Collect intelligence on all vulnerabilities in the product's technology stack

Monitor all known threat actors to ensure no threat is missed

Wait for a security incident to occur before starting collection

GIAC Cyber Threat Intelligence

Domain 1Objective 1

Intelligence Fundamentals GCTI Practice Questions (Page 5)

Part of the Intelligence Fundamentals domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 8–14 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 21–25

21application · medium
A threat intelligence team has produced a report on a new malware campaign. The report is intended for both the executive team and the SOC. The team has limited time and must disseminate the report. What is the best approach?
Select an answer first
22application · medium
A financial services firm has just experienced a ransomware attack that disrupted trading operations for six hours. The board has approved a new threat intelligence program and wants to ensure that future attacks are detected earlier. The CTI team is defining the first intelligence cycle. Which action should the team take FIRST to ensure the cycle produces actionable results?
Select an answer first
23application · medium
A cyber threat intelligence team is tasked with producing a quarterly report for the board of directors. The report must summarize the top threats facing the organization and justify the security budget. The team has collected a large volume of raw data from multiple sources, but the analysts are overwhelmed and the report is due in two weeks. Which step of the intelligence lifecycle should the team prioritize to ensure the report is useful and delivered on time?
Select an answer first
24expert · medium
A CTI team is establishing a new intelligence capability. The team has limited budget and must choose between two collection strategies: (1) purchasing a commercial threat intelligence feed that provides a high volume of indicators, or (2) building a small internal team that conducts targeted collection based on the organization's specific intelligence requirements. The organization's primary need is to support incident response for a specific set of critical assets. Which strategy is MOST aligned with the intelligence cycle and the organization's need?
Select an answer first
25application · medium
A threat intelligence team is tasked with supporting a new product launch. The product team is concerned about intellectual property theft. The security team has limited collection resources. Which intelligence requirement is most appropriate to guide collection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Intelligence Fundamentals GCTI Practice Questions (Page 5)

Questions 21–25

A threat intelligence team has produced a report on a new malware campaign. The report is intended for both the executive team and the SOC. The team has limited time and must disseminate the report. What is the best approach?

A threat intelligence team is tasked with supporting a new product launch. The product team is concerned about intellectual property theft. The security team has limited collection resources. Which intelligence requirement is most appropriate to guide collection?

Keep studying — Intelligence Fundamentals