A threat intelligence analyst is using the Diamond Model to analyze a cyber event. The analyst has identified the following: the attacker used a specific exploit kit to compromise a website, the website was hosted on a server in a cloud provider, and the victims were visitors to the website. Which of the following correctly identifies the infrastructure in this event?

The cloud server hosting the website

A threat intelligence analyst is documenting a series of intrusions where the same attacker group used different malware families and infrastructure for each victim. The analyst wants to use the Diamond Model to structure the data. Which of the following correctly represents the core features for one of these events?

Adversary: the malware family; Infrastructure: the victim's IP; Capability: the attacker group; Victim: the C2 domain

Adversary: the C2 domain; Infrastructure: the attacker group; Capability: the targeted organization; Victim: the malware family

Adversary: the attacker group; Infrastructure: the C2 domain; Capability: the malware family; Victim: the targeted organization

Adversary: the targeted organization; Infrastructure: the malware family; Capability: the attacker group; Victim: the C2 domain

GIAC Cyber Threat Intelligence

Domain 4Objective 1

Kill Chain, Diamond Model, and Courses of Action Matrix GCTI Practice Questions (Page 2)

Part of the Operational Frameworks and Models domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–11 in this domain), expect 6–11 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

Questions 6–10

6application · medium
A threat intelligence analyst is using the Diamond Model to analyze a cyber event. The analyst has identified the following: the attacker used a specific exploit kit to compromise a website, the website was hosted on a server in a cloud provider, and the victims were visitors to the website. Which of the following correctly identifies the infrastructure in this event?
Select an answer first
7foundation · easy
Which of the following is one of the four core features of the Diamond Model?
Select an answer first
8foundation · easy
Which kill chain stage is characterized by the adversary establishing a foothold in the target environment, such as installing a persistent backdoor?
Select an answer first
9application · medium
A threat intelligence analyst is documenting a series of intrusions where the same attacker group used different malware families and infrastructure for each victim. The analyst wants to use the Diamond Model to structure the data. Which of the following correctly represents the core features for one of these events?
Select an answer first
10application · medium
A security team is developing a defensive strategy against a known adversary that uses USB drives dropped in parking lots to deliver malware. The team wants to implement a course of action that prevents the initial infection vector from succeeding. Which COA category is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Kill Chain, Diamond Model, and Courses of Action Matrix GCTI Practice Questions (Page 2)

Questions 6–10

Which of the following is one of the four core features of the Diamond Model?

Which kill chain stage is characterized by the adversary establishing a foothold in the target environment, such as installing a persistent backdoor?

A security team is developing a defensive strategy against a known adversary that uses USB drives dropped in parking lots to deliver malware. The team wants to implement a course of action that prevents the initial infection vector from succeeding. Which COA category is most appropriate?

Keep studying — Operational Frameworks and Models