Intelligence Fundamentals GCTI Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A threat intelligence team supports both the security operations center (SOC) and the executive board. The SOC needs tactical indicators to block ongoing attacks, while the board needs strategic assessments to guide investment. The team has a limited budget and must prioritize its collection and analysis efforts. What is the most effective way to manage these competing requirements?

   • AFocus exclusively on the SOC's tactical needs, as they are more urgent
   • BAlternate between tactical and strategic focus on a monthly basis
   • CDevelop a set of intelligence requirements that address both tactical and strategic needs, and allocate resources based on the current threat landscape
   • DFocus exclusively on the board's strategic needs, as they set the budget
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An analyst is building a profile of a threat actor that has been targeting the organization. The analyst has collected data from a dark web forum where the actor is active, a sandbox report of a malware sample, and a public blog post from a security researcher. Which source is most likely to provide insight into the actor's motivations and future intentions?

   • AThe sandbox report, as it shows the technical behavior of the malware
   • BThe security researcher's blog post, as it is an authoritative analysis
   • CAll sources are equally valuable for understanding motivations
   • DThe dark web forum posts, as they may reveal the actor's discussions and plans
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A mid-sized company is considering whether to build an in-house CTI capability or rely solely on a commercial threat intelligence feed. The company's security team is small and has limited time to analyze raw data. The CISO wants intelligence that directly supports the company's risk management decisions, such as which vulnerabilities to patch first. Which approach BEST aligns with the core purpose of cyber threat intelligence?

   • AUse the commercial feed as a source but apply internal analysis to prioritize threats based on the company's specific assets and risks.
   • BSubscribe to the commercial feed and automatically block all indicators it provides without additional analysis.
   • CRely on the commercial feed's vendor reports to make patching decisions without considering the company's environment.
   • DBuild an in-house team that collects raw data from the dark web and performs all analysis from scratch.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An analyst is tracking a new ransomware family that appears to target manufacturing companies. The analyst has found several samples on a public malware repository and has also seen discussions about the ransomware on a private forum. The analyst needs to determine the ransomware's capabilities and potential impact. Which source would provide the MOST reliable and detailed technical analysis?

   • AA detailed reverse-engineering report from a reputable security vendor that includes behavioral analysis and indicators of compromise.
   • BA news article that summarizes the ransomware's impact on a recent victim.
   • CThe raw malware samples themselves, which the analyst can run in a sandbox to observe behavior.
   • DA post on a private forum where a user claims to have tested the ransomware and describes its behavior.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the primary goal of transforming raw data into actionable intelligence?

   • ATo automate all security operations without human intervention
   • BTo store data in a centralized repository for future reference
   • CTo enable decision-makers to take specific actions that reduce risk or mitigate threats
   • DTo create a permanent record of all collected data
   Reveal Solution Discussion Select an answer first