Malware as a Collection Source GCTI Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A threat intelligence analyst is considering using a honeypot to collect malware samples from attackers. The honeypot is connected to the internet and is designed to appear as a vulnerable server. Which legal or ethical consideration is most critical when operating this honeypot?

   • AObtain consent from all attackers before collecting their malware.
   • BEnsure the honeypot is not connected to the internet to avoid any legal liability.
   • CEnsure the honeypot does not inadvertently harm third parties, such as by launching attacks or spreading malware beyond the honeypot.
   • DRegister the honeypot as a formal intelligence collection system with the government.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How can malware analysis contribute to campaign attribution?

   • ABy determining the exact identity of the individual malware author from the binary
   • BBy proving that the malware was created by a specific nation-state government
   • CBy identifying unique code reuse, infrastructure, and behavioral patterns that link a sample to a known threat group
   • DBy measuring the malware's infection rate to infer the attacker's motivation
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A CTI team is analyzing a worm that has infected multiple organizations. The team wants to determine if the worm is related to a known campaign. Which type of intelligence extracted from the malware would be most useful for this comparison?

   • AThe worm's programming language and compiler used.
   • BThe worm's propagation method (e.g., USB, network shares).
   • CThe worm's file size and compile timestamp.
   • DThe worm's unique encryption keys and C2 server addresses.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations center (SOC) receives a malware sample from an internal host. The SOC wants to use the sample to identify the attacker's infrastructure and improve their detection capabilities. Which sequence of actions best achieves this goal?

   • ADelete the sample after documenting its file name and size.
   • BPerform static and dynamic analysis to extract indicators, then correlate those indicators with threat intelligence feeds to identify related infrastructure.
   • CImmediately block the sample's hash in all security tools and move on to the next alert.
   • DSend the sample to an external sandbox and wait for the report without further analysis.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst discovers a suspicious binary on an internal workstation. The analyst needs to determine whether the binary is a known commodity trojan or a custom implant, and to extract any embedded configuration that could reveal command-and-control infrastructure. Which approach best supports this intelligence collection goal?

   • ADelete the binary immediately to prevent further infection, then rely on endpoint detection alerts for future incidents.
   • BRun the binary in a sandbox and capture network traffic to identify callbacks, then compare the binary's hash against public malware repositories.
   • CUse a hex editor to manually inspect every byte of the binary without executing it, looking for plaintext C2 addresses.
   • DSubmit the binary to a public online scanner and wait for the vendor report, without performing any local analysis.
   Reveal Solution Discussion Select an answer first