Intelligence Fundamentals GCTI Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A CTI analyst is investigating a phishing campaign targeting the company's finance department. The analyst has access to the full email headers of the phishing messages, the malicious URLs, and the payload hashes. The analyst also has a subscription to a commercial threat intelligence platform that aggregates data from multiple vendors. The analyst needs to determine whether this campaign is linked to a known threat actor. Which combination of sources would provide the STRONGEST evidence for attribution?

   • ASearch public social media for mentions of the phishing campaign and rely on the most popular posts to identify the threat actor.
   • BCompare the payload hashes and infrastructure details against the commercial threat intelligence platform's historical data and reports.
   • CAsk the finance department to reply to the phishing email to gather more information about the sender's infrastructure.
   • DUse only the payload hashes to search a free online malware repository and assume any match indicates the same threat actor.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the key difference between human intelligence (HUMINT) and signals intelligence (SIGINT) in the context of cyber threat intelligence?

   • AHUMINT involves technical collection, while SIGINT involves personal interviews
   • BHUMINT is derived from human sources, while SIGINT is derived from intercepted communications and electronic signals
   • CHUMINT is always more reliable than SIGINT
   • DSIGINT is only used by government agencies, while HUMINT is used by private companies
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A threat intelligence analyst is investigating a phishing campaign targeting the organization's employees. The analyst has access to email headers from the phishing emails, public reports from security vendors, and internal login logs. The analyst needs to determine the likely motive and sophistication of the threat actor. Which combination of sources would be most effective for this analysis?

   • AInternal login logs alone, since they show what actually happened
   • BOnly public vendor reports, as they are the most authoritative source
   • CEmail headers and internal login logs only, as they are primary sources
   • DPublic vendor reports and internal login logs, supplemented by email headers for technical detail
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An analyst is investigating a series of data breaches in the healthcare sector. The analyst has access to breach notification reports, a commercial threat intelligence feed, and a vulnerability scanner. The analyst needs to identify the most common initial access vectors used in these breaches. Which source is most appropriate?

   • AThe commercial threat intelligence feed, as it provides real-time indicators of compromise
   • BThe vulnerability scanner, as it shows which vulnerabilities exist in the organization
   • CAll sources are equally useful for this analysis
   • DThe breach notification reports, as they often describe the cause and initial access vector of each breach
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An intelligence analyst has collected data from multiple sources indicating that a known threat actor is targeting the organization's industry. The data includes raw IP addresses, malware hashes, and open-source reports. The analyst must produce a finished intelligence product for the security operations center (SOC) to help them prioritize alerts. What is the most important step the analyst should take?

   • ADisseminate the raw indicators to the SOC as quickly as possible
   • BCollect more data from additional sources to ensure completeness
   • CStore the data in a threat intelligence platform for future use
   • DCorrelate the indicators with internal network traffic to identify potential compromises
   Reveal Solution Discussion Select an answer first