An organization has been targeted by an adversary that uses a specific vulnerability in a legacy application. The vulnerability is not yet patched, and the vendor has not released a fix. The security team has identified the adversary's infrastructure and wants to implement a course of action that will reduce the risk of exploitation while waiting for the patch. Which course of action is most appropriate?

Deceive the adversary by creating a honeypot that mimics the legacy application

Disrupt the adversary's infrastructure by taking down their command-and-control servers

Degrade the legacy application's functionality to make exploitation more difficult

Deny access to the legacy application from the internet

GIAC Cyber Threat Intelligence

Domain 4Objective 1

Kill Chain, Diamond Model, and Courses of Action Matrix GCTI Practice Questions (Page 7)

Part of the Operational Frameworks and Models domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–11 in this domain), expect 6–11 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

Questions 31–35

31foundation · easy
An analyst observes that an adversary sent a spear-phishing email with a malicious attachment to a company employee. Which kill chain stage does this activity represent?
Select an answer first
32application · medium
An analyst is using the Diamond Model to analyze a campaign. The analyst has identified the adversary, the infrastructure, the capability, and the victim. The analyst also records the time of the event, the phase of the intrusion, and the result. Which of the following is the analyst adding to the model?
Select an answer first
33foundation · easy
In the cyber kill chain, which stage involves the adversary delivering a weaponized payload to the target environment?
Select an answer first
34expert · hard
An organization has been targeted by an adversary that uses a specific vulnerability in a legacy application. The vulnerability is not yet patched, and the vendor has not released a fix. The security team has identified the adversary's infrastructure and wants to implement a course of action that will reduce the risk of exploitation while waiting for the patch. Which course of action is most appropriate?
Select an answer first
35foundation · easy
An organization wants to prevent an adversary from using a known malicious domain for command and control. Which COA category is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Kill Chain, Diamond Model, and Courses of Action Matrix GCTI Practice Questions (Page 7)

Questions 31–35

An analyst observes that an adversary sent a spear-phishing email with a malicious attachment to a company employee. Which kill chain stage does this activity represent?

In the cyber kill chain, which stage involves the adversary delivering a weaponized payload to the target environment?

An organization wants to prevent an adversary from using a known malicious domain for command and control. Which COA category is most appropriate?

Keep studying — Operational Frameworks and Models