Intelligence Fundamentals GCTI Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A CTI analyst has collected data on a phishing campaign that targets the company's employees. The data includes the phishing email content, the malicious URLs, and the payload hashes. The analyst needs to produce an intelligence product that will help the company's security awareness team improve training. Which type of product would be MOST useful for this purpose?

   • AA report that describes the phishing lure, the indicators of compromise, and recommended actions for employees to identify similar emails.
   • BA strategic analysis of the threat actor's motivations and long-term objectives.
   • CA list of the payload hashes and URLs for the security operations team to block.
   • DA technical analysis of the malware's code and its capabilities.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A small company has a mature security operations team but no formal CTI capability. The team occasionally reads threat reports from vendors and government agencies. The company is considering whether to invest in a formal CTI program. Which outcome would BEST demonstrate the value of a formal CTI program?

   • AThe program produces a weekly report that summarizes the latest threats and vulnerabilities.
   • BThe program provides context and analysis that helps the company prioritize security investments based on the threats most relevant to its industry.
   • CThe program automates the blocking of all known malicious IP addresses.
   • DThe program collects a large number of indicators of compromise from multiple sources.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A threat intelligence analyst has identified a new phishing kit being sold on a dark web forum. The analyst has the kit's source code and a list of domains used in recent campaigns. The analyst needs to produce a product that will help the organization's email security team block these campaigns. What is the most useful product?

   • AA general warning about phishing attacks in the industry
   • BA raw dump of the phishing kit's source code for the email security team to analyze
   • CA list of indicators of compromise (IOCs) including domains and file hashes, with context on the phishing kit's behavior
   • DA strategic report on the rise of phishing kits in the dark web
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A small company has a limited security budget and no dedicated threat intelligence team. The CEO asks the IT manager to 'start doing threat intelligence' to reduce the risk of a data breach. The IT manager has access to a commercial threat intelligence feed and a basic SIEM. What is the most appropriate first step to build a sustainable threat intelligence capability?

   • AIngest the commercial feed into the SIEM and alert on all matches
   • BHire a threat intelligence analyst to manually review all alerts
   • CDefine the organization's key assets and the threats that could impact them, then tailor the feed and alerts accordingly
   • DPurchase a more expensive threat intelligence platform to automate everything
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A threat intelligence analyst is preparing a briefing for senior management about a new ransomware group. The analyst has collected technical indicators, victimology data, and open-source reporting. The briefing must help management understand the potential impact on the organization and decide whether to invest in additional defenses. Which type of intelligence product is most appropriate?

   • AAn operational report detailing the group's recent campaigns and their impact on similar organizations
   • BA raw data dump of all collected indicators for management to review
   • CA technical analysis of the ransomware's code to identify potential weaknesses
   • DA tactical report listing the ransomware's file hashes and command-and-control IP addresses
   Reveal Solution Discussion Select an answer first