A threat intelligence analyst is documenting a series of intrusions. In each event, the same threat actor used a unique domain for command-and-control, but the malware family and the targeted industry remained consistent. The analyst wants to use the Diamond Model to structure the data. Which element should be recorded as the 'infrastructure' in these events?

The malware family used in each intrusion

The unique command-and-control domain

What is the primary purpose of the Courses of Action (COA) matrix in defensive cyber operations?

To replace the need for human decision-making in incident response

To assign a severity score to each detected threat

To provide a structured set of options for disrupting an adversary's activity at different stages of the kill chain

To automatically block all malicious IP addresses

Which of the following best describes the Courses of Action (COA) matrix?

A method for attributing attacks to specific threat actors

A list of all known malware signatures

A framework for categorizing defensive actions against adversary activities

A tool for predicting future cyber attacks

GIAC Cyber Threat Intelligence

Domain 4Objective 1

Kill Chain, Diamond Model, and Courses of Action Matrix GCTI Practice Questions (Page 6)

Part of the Operational Frameworks and Models domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–11 in this domain), expect 6–11 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

Questions 26–30

26application · medium
A threat intelligence analyst is documenting a series of intrusions. In each event, the same threat actor used a unique domain for command-and-control, but the malware family and the targeted industry remained consistent. The analyst wants to use the Diamond Model to structure the data. Which element should be recorded as the 'infrastructure' in these events?
Select an answer first
27foundation · easy
What is the primary purpose of the Courses of Action (COA) matrix in defensive cyber operations?
Select an answer first
28application · medium
A security team has identified a malicious domain used for command-and-control. The team wants to take an action that will make the domain unusable for the adversary while preserving the ability to monitor the adversary's activities. Which COA category is most appropriate?
Select an answer first
29foundation · easy
Which of the following best describes the Courses of Action (COA) matrix?
Select an answer first
30foundation · easy
During an incident, analysts want to feed false information to an adversary to mislead them about the location of critical data. Which COA category does this action fall under?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Kill Chain, Diamond Model, and Courses of Action Matrix GCTI Practice Questions (Page 6)

Questions 26–30

What is the primary purpose of the Courses of Action (COA) matrix in defensive cyber operations?

A security team has identified a malicious domain used for command-and-control. The team wants to take an action that will make the domain unusable for the adversary while preserving the ability to monitor the adversary's activities. Which COA category is most appropriate?

Which of the following best describes the Courses of Action (COA) matrix?

During an incident, analysts want to feed false information to an adversary to mislead them about the location of critical data. Which COA category does this action fall under?

Keep studying — Operational Frameworks and Models