Malware as a Collection Source GCTI Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A threat intelligence analyst is considering using a live ransomware sample to collect intelligence on the attacker's encryption behavior and ransom note delivery. The analyst has a sandbox with network isolation. Which action is most appropriate from a legal and ethical standpoint?

   • ADeploy the sample on a honeypot connected to the production network to observe real-world impact.
   • BUpload the sample to a public malware repository without any analysis.
   • CExecute the sample in the isolated sandbox and document its behavior for intelligence purposes.
   • DRun the sample on a personal laptop outside the corporate network to avoid policy restrictions.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An intelligence team has analyzed a new banking trojan and extracted a list of C2 domains, a unique encryption key, and a set of YARA rules. The team must decide how to share this intelligence with other organizations in their sector. Which sharing approach best maximizes the value of the intelligence while minimizing risk?

   • AKeep all intelligence internal and only share it with law enforcement.
   • BShare only the YARA rules, because C2 domains change frequently and are less reliable.
   • CPublish the YARA rules and C2 domains to a sector-specific threat intelligence sharing platform, while keeping the encryption key private.
   • DPublish all extracted intelligence, including the encryption key, to a public malware repository.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's security team discovers a worm that has been spreading through their network using a known SMB vulnerability. The team wants to use this malware as an intelligence source to improve future defenses. Which action best leverages the malware for intelligence collection?

   • ADelete all copies of the worm and reimage affected systems without further analysis.
   • BAnalyze the worm's propagation method and identify the specific vulnerability it exploits, then use that information to prioritize patching and network segmentation.
   • CReport the worm to law enforcement and wait for their analysis before taking any internal action.
   • DDisconnect the network from the internet to prevent the worm from spreading further.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A threat intelligence team is analyzing a ransomware sample that encrypts files and leaves a ransom note. The team wants to produce actionable intelligence for the organization's defenders. Which output would be most directly actionable for defenders?

   • AAn attribution assessment linking the ransomware to a known threat group.
   • BA detailed report on the ransomware's encryption algorithm and key length.
   • CA list of file extensions targeted by the ransomware and the ransom note's payment instructions.
   • DIndicators of compromise (IOCs) such as the ransomware's hashes, C2 domains, and mutex names.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is a key legal consideration when collecting malware samples for intelligence purposes?

   • AObtaining a warrant from a court before analyzing any malware sample
   • BDeleting all malware samples after analysis to avoid legal liability
   • CEnsuring that the collection method complies with applicable laws and regulations, such as computer fraud and data protection laws
   • DPaying the malware author for the sample to avoid copyright infringement
   Reveal Solution Discussion Select an answer first