In cyber threat intelligence, what is the primary role of malware as a collection source?

To replace human analysts by automatically generating finished intelligence reports

To act as a legal mechanism for attributing cyber attacks to specific nation-states

To serve as a direct communication channel between intelligence analysts and threat actors

To provide a repository of indicators and behavioral data that can be analyzed to understand adversary operations

An intelligence analyst has finished analyzing a new backdoor and has identified several indicators, including a unique mutex name, a C2 domain, and a specific registry key it creates. Which of the following is the most effective way to package these indicators for use by the security operations center?

Verbally communicate the indicators to the SOC during a meeting.

Create a PDF report with screenshots of the analysis and the indicators.

Create a STIX/TAXII bundle containing the mutex, domain, and registry key as observable objects, and share it with the SOC.

Write a plain-text email to the SOC listing the indicators in bullet points.

After analyzing a ransomware sample, an intelligence analyst identifies a unique hardcoded wallet address and a specific file-extension pattern used by the malware. Which of the following is the most actionable intelligence product for network defenders?

A strategic assessment of the ransomware group's likely motivations based on the wallet address.

A threat intelligence report that includes the wallet address, file-extension pattern, and recommended detection rules.

A recommendation to increase the organization's cyber insurance coverage.

A list of all files that were encrypted on the affected system, for forensic documentation.

An analyst is examining a worm that spreads via USB drives. The analyst needs to identify the worm's propagation method and any files it drops. Which combination of analysis techniques would be most effective?

Only dynamic analysis in a standard sandbox without USB emulation.

Only static analysis using a disassembler to read the worm's source code.

Submit the worm to an antivirus vendor for signature generation.

Static analysis of the binary's code and dynamic analysis in a sandbox with a simulated USB drive.

Which malware type is most valuable for understanding an adversary's data exfiltration techniques?

Ransomware, because it often encrypts data and demands payment

A trojan with data-stealing capabilities that can upload files to an external server

A worm that self-replicates to spread across the network

A bootkit that infects the master boot record to maintain persistence

GIAC Cyber Threat Intelligence

Domain 2Objective 2

Malware as a Collection Source GCTI Practice Questions (Page 4)

Part of the Intelligence Collection and Storage domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 8–14 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 16–20

16foundation · easy
In cyber threat intelligence, what is the primary role of malware as a collection source?
Select an answer first
17application · medium
An intelligence analyst has finished analyzing a new backdoor and has identified several indicators, including a unique mutex name, a C2 domain, and a specific registry key it creates. Which of the following is the most effective way to package these indicators for use by the security operations center?
Select an answer first
18application · medium
After analyzing a ransomware sample, an intelligence analyst identifies a unique hardcoded wallet address and a specific file-extension pattern used by the malware. Which of the following is the most actionable intelligence product for network defenders?
Select an answer first
19application · medium
An analyst is examining a worm that spreads via USB drives. The analyst needs to identify the worm's propagation method and any files it drops. Which combination of analysis techniques would be most effective?
Select an answer first
20foundation · easy
Which malware type is most valuable for understanding an adversary's data exfiltration techniques?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.