Intelligence Fundamentals GCTI Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A CTI analyst has collected data from multiple sources indicating that a known threat actor is using a new phishing lure that mimics a popular software update. The analyst has confirmed the lure is being used in the wild and has identified the infrastructure hosting the malicious files. The analyst needs to produce an intelligence product that will help the SOC block the threat. Which product would be MOST useful to the SOC?

   • AA tactical report that includes the malicious URLs, file hashes, and recommended detection rules.
   • BA summary of the phishing lure's design and why it is effective.
   • CA strategic report that explains the threat actor's motivations and long-term objectives.
   • DA list of the threat actor's suspected aliases and historical targets.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A cyber threat intelligence team has just delivered a detailed report on a new malware campaign to the incident response team. The incident response team found the report useful but noted that the indicators of compromise (IOCs) were not in a machine-readable format, which slowed down their automated detection. What should the intelligence team do to improve future reports?

   • AAsk the incident response team for feedback and adjust the dissemination format to include STIX/TAXII or other machine-readable IOCs
   • BSkip the written report and only provide raw IOCs in the future
   • CDisseminate the report only to the incident response team to avoid leaking sensitive information
   • DCollect more data on the malware campaign to make the report more comprehensive
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   How does feedback from stakeholders refine the intelligence cycle?

   • ABy replacing the need for formal intelligence requirements
   • BBy ensuring that all intelligence is disseminated to all stakeholders equally
   • CBy identifying gaps in intelligence and adjusting requirements for future collection and analysis
   • DBy automatically blocking threats identified in the intelligence
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company's security team has been collecting threat intelligence feeds for months but has not used them to make any security decisions. The CISO asks the team to explain the value of the intelligence program. Which statement BEST describes the core purpose of cyber threat intelligence in this context?

   • ATo collect as many indicators of compromise as possible to build a large database.
   • BTo automate all security responses without human intervention.
   • CTo provide context and analysis that enables the organization to make informed decisions about security risks and responses.
   • DTo replace the need for other security controls such as firewalls and endpoint protection.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In the intelligence lifecycle, what occurs during the 'processing' stage?

   • AIntelligence requirements are defined and prioritized
   • BRaw data is converted into a format that can be analyzed, such as normalizing logs or decoding malware
   • CIntelligence is delivered to stakeholders in the form of reports or briefings
   • DAnalysts apply analytical techniques to identify patterns and draw conclusions
   Reveal Solution Discussion Select an answer first