An analyst is populating a Diamond Model event for a phishing attack. The analyst records the date and time of the email, the direction of the attack (from adversary to victim), and the outcome (the victim clicked the link). Which meta-features is the analyst using?

Timestamp, phase, and methodology

Direction, result, and resources

Phase, methodology, and resources

Timestamp, direction, and result

GIAC Cyber Threat Intelligence

Domain 4Objective 1

Kill Chain, Diamond Model, and Courses of Action Matrix GCTI Practice Questions (Page 3)

Part of the Operational Frameworks and Models domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–11 in this domain), expect 6–11 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

Questions 11–15

11application · medium
An analyst is populating a Diamond Model event for a phishing attack. The analyst records the date and time of the email, the direction of the attack (from adversary to victim), and the outcome (the victim clicked the link). Which meta-features is the analyst using?
Select an answer first
12foundation · easy
In the Diamond Model, which core feature represents the person or group responsible for an intrusion?
Select an answer first
13foundation · easy
An analyst is using the Diamond Model to document a phishing campaign. They identify the email address used to send the phishing messages. Which core feature does this email address represent?
Select an answer first
14application · medium
An analyst is reviewing a log of an intrusion. The log shows the attacker sent a crafted email to a user, the user opened the attachment, the attachment exploited a vulnerability in the PDF reader, and then the attacker downloaded additional tools. Which kill chain stage is most directly associated with the PDF reader vulnerability being exploited?
Select an answer first
15application · medium
An analyst is using the Diamond Model to analyze a series of events. In each event, the same adversary uses a different malware variant, but the victim is always a specific type of industrial control system. The analyst wants to identify the relationship between the adversary and the victim. Which Diamond Model edge represents this relationship?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Kill Chain, Diamond Model, and Courses of Action Matrix GCTI Practice Questions (Page 3)

Questions 11–15

An analyst is populating a Diamond Model event for a phishing attack. The analyst records the date and time of the email, the direction of the attack (from adversary to victim), and the outcome (the victim clicked the link). Which meta-features is the analyst using?

In the Diamond Model, which core feature represents the person or group responsible for an intrusion?

An analyst is using the Diamond Model to document a phishing campaign. They identify the email address used to send the phishing messages. Which core feature does this email address represent?

Keep studying — Operational Frameworks and Models