A threat intelligence team is considering whether to share a malware sample they analyzed with a government agency. The sample contains a unique encryption key that could be used to decrypt victim files. Which consideration should guide their decision?

Share only the sample but not the key, because the key is not useful to law enforcement.

Share the sample and key immediately because government agencies always handle intelligence responsibly.

Weigh the potential benefit of helping law enforcement against the risk of the key being misused or leaked.

Refuse to share any information with government agencies to protect the organization's reputation.

An analyst is examining a malware sample that, when executed, creates a backdoor and also downloads additional payloads from a remote server. The sample does not self-replicate. Which malware type is this, and what is its most valuable intelligence contribution?

Worm; the intelligence value lies in analyzing its self-propagation technique.

Ransomware; the intelligence value lies in identifying the encryption keys used.

Trojan; the intelligence value lies in identifying the remote server and the additional payloads it downloads.

Virus; the intelligence value lies in understanding how it infects other files.

During incident response, an analyst finds a file that encrypts user documents and displays a ransom note demanding payment in cryptocurrency. The analyst also observes that the malware attempts to spread to other machines via SMB shares. Which type of malware best describes this threat, and what is its primary intelligence value?

Spyware; the intelligence value lies in capturing credentials and monitoring user activity.

Trojan; the intelligence value lies in identifying the payload delivery mechanism and the dropper's origin.

Ransomware; the intelligence value lies in identifying the encryption routine and the payment infrastructure used by the attackers.

Worm; the intelligence value lies in mapping the network propagation method and the vulnerability exploited.

A CTI analyst wants to collect intelligence from a botnet's malware sample. The analyst has legal approval to analyze the sample but is concerned about privacy laws because the malware may contain personal data from infected victims. Which action best balances intelligence needs with legal and ethical obligations?

Delete the sample without analysis to avoid any legal risk.

Extract all data from the sample, including personal information, to fully understand the botnet's impact.

Analyze the sample in a sandbox and only record technical indicators, avoiding any extraction of personal data.

Share the sample with law enforcement and let them handle the personal data.

Which activity is part of dynamic malware analysis?

Reviewing the import table of the executable to see which Windows APIs it uses

Observing the malware's behavior in a virtual machine, such as file system changes and network traffic

Computing the SHA-256 hash of the malware sample

Extracting hardcoded IP addresses from the binary using a hex editor

GIAC Cyber Threat Intelligence

Domain 2Objective 2

Malware as a Collection Source GCTI Practice Questions (Page 7)

Part of the Intelligence Collection and Storage domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 8–14 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 31–35

31application · medium
A threat intelligence team is considering whether to share a malware sample they analyzed with a government agency. The sample contains a unique encryption key that could be used to decrypt victim files. Which consideration should guide their decision?
Select an answer first
32application · medium
An analyst is examining a malware sample that, when executed, creates a backdoor and also downloads additional payloads from a remote server. The sample does not self-replicate. Which malware type is this, and what is its most valuable intelligence contribution?
Select an answer first
33application · medium
During incident response, an analyst finds a file that encrypts user documents and displays a ransom note demanding payment in cryptocurrency. The analyst also observes that the malware attempts to spread to other machines via SMB shares. Which type of malware best describes this threat, and what is its primary intelligence value?
Select an answer first
34expert · hard
A CTI analyst wants to collect intelligence from a botnet's malware sample. The analyst has legal approval to analyze the sample but is concerned about privacy laws because the malware may contain personal data from infected victims. Which action best balances intelligence needs with legal and ethical obligations?
Select an answer first
35foundation · easy
Which activity is part of dynamic malware analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.