A security team is responding to a ransomware attack. The ransomware has encrypted files on several servers, and the team has identified the C2 infrastructure and the initial access vector (a phishing email). The team wants to both recover from the current attack and prevent future attacks using the same vector. Which combination of courses of action is most appropriate?

Detect the phishing email and deny the C2 communication

Destroy the ransomware and degrade the C2 infrastructure

Deny the phishing email and disrupt the C2 communication

Disrupt the C2 communication and deny the phishing email

Which combination of models would an analyst use to both understand the structure of an intrusion event and determine appropriate defensive actions?

Kill chain and Diamond Model only

GIAC Cyber Threat Intelligence

Domain 4Objective 1

Kill Chain, Diamond Model, and Courses of Action Matrix GCTI Practice Questions (Page 4)

Part of the Operational Frameworks and Models domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–11 in this domain), expect 6–11 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

Questions 16–20

16application · medium
A security operations center (SOC) has identified a command and control (C2) domain that is being used by a threat actor to communicate with malware on infected hosts. The SOC wants to prevent the infected hosts from communicating with the C2 domain. Which course of action is most appropriate?
Select an answer first
17expert · hard
A security team is responding to a ransomware attack. The ransomware has encrypted files on several servers, and the team has identified the C2 infrastructure and the initial access vector (a phishing email). The team wants to both recover from the current attack and prevent future attacks using the same vector. Which combination of courses of action is most appropriate?
Select an answer first
18foundation · easy
Which combination of models would an analyst use to both understand the structure of an intrusion event and determine appropriate defensive actions?
Select an answer first
19foundation · easy
During an incident, analysts discover that an adversary has been exfiltrating sensitive data from a compromised server. Which kill chain stage does this activity represent?
Select an answer first
20foundation · easy
Which COA category involves taking action to stop an adversary's ongoing activity, such as terminating a malicious process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Kill Chain, Diamond Model, and Courses of Action Matrix GCTI Practice Questions (Page 4)

Questions 16–20

A security operations center (SOC) has identified a command and control (C2) domain that is being used by a threat actor to communicate with malware on infected hosts. The SOC wants to prevent the infected hosts from communicating with the C2 domain. Which course of action is most appropriate?

Which combination of models would an analyst use to both understand the structure of an intrusion event and determine appropriate defensive actions?

During an incident, analysts discover that an adversary has been exfiltrating sensitive data from a compromised server. Which kill chain stage does this activity represent?

Which COA category involves taking action to stop an adversary's ongoing activity, such as terminating a malicious process?

Keep studying — Operational Frameworks and Models