An analyst is documenting a pivot chain for a report that will be shared with a partner organization. The chain involves a domain that was sinkholed by law enforcement, and the analyst used passive DNS data that is licensed for internal use only. What is the most appropriate way to document the chain?

Include the full passive DNS data in the report to ensure reproducibility.

Omit the passive DNS step entirely to avoid licensing issues.

Share the raw data only with trusted partners, not in the report.

Document the pivot steps and sources, but redact any data that is restricted by license or sensitivity.

Why is it important to document the pivot chain when conducting threat intelligence analysis?

To ensure the analysis can be reproduced and shared with other analysts

To increase the number of indicators in the report

To make the report longer and more detailed

To avoid the need for confidence scoring

An analyst is investigating a targeted intrusion. A known malicious domain (malicious.com) resolves to IP 203.0.113.5. Passive DNS shows that IP has hosted 200 domains over the past three years, including many legitimate small businesses. WHOIS for malicious.com shows a registrant email that also appears in 10 other domains, all of which are known to be malicious. The analyst has limited time and must decide which pivot to pursue first to maximize confidence in finding related infrastructure. What should the analyst do?

Perform a temporal pivot to find domains registered within the same week as malicious.com.

Pivot from the IP to the 10 domains that share the registrant email, ignoring the rest.

Pivot from the IP to all 200 domains and investigate each one.

Pivot from the registrant email to the 10 other domains and analyze their infrastructure.

What is a common limitation of pivoting that can lead to false positives?

Shared infrastructure, such as a public cloud IP used by many unrelated services

The availability of threat intelligence platforms

GIAC Cyber Threat Intelligence

Domain 5Objective 1

Pivoting GCTI Practice Questions (Page 1)

Part of the Advanced Analysis Techniques domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 7–12 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 1–5

1expert · hard
An analyst is documenting a pivot chain for a report that will be shared with a partner organization. The chain involves a domain that was sinkholed by law enforcement, and the analyst used passive DNS data that is licensed for internal use only. What is the most appropriate way to document the chain?
Select an answer first
2foundation · easy
Why is it important to document the pivot chain when conducting threat intelligence analysis?
Select an answer first
3foundation · easy
An analyst starts with a single malicious file hash and uses it to find other files with similar behavior. Which term best describes this action?
Select an answer first
4expert · hard
An analyst is investigating a targeted intrusion. A known malicious domain (malicious.com) resolves to IP 203.0.113.5. Passive DNS shows that IP has hosted 200 domains over the past three years, including many legitimate small businesses. WHOIS for malicious.com shows a registrant email that also appears in 10 other domains, all of which are known to be malicious. The analyst has limited time and must decide which pivot to pursue first to maximize confidence in finding related infrastructure. What should the analyst do?
Select an answer first
5foundation · easy
What is a common limitation of pivoting that can lead to false positives?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Pivoting GCTI Practice Questions (Page 1)

Questions 1–5

Why is it important to document the pivot chain when conducting threat intelligence analysis?

An analyst starts with a single malicious file hash and uses it to find other files with similar behavior. Which term best describes this action?

What is a common limitation of pivoting that can lead to false positives?

Keep studying — Advanced Analysis Techniques