An analyst is documenting a pivot chain for a threat intelligence report. The chain is: malicious file hash -> sandbox report -> C2 domain -> passive DNS -> related IPs. What is the best way to present this chain in the report?

A narrative paragraph describing the conclusions

A table listing only the final indicators

A visual diagram showing each pivot step and the data source used

A list of all indicators with their threat scores

An analyst has a malicious email address and wants to find other domains associated with the same threat actor. Which pivot technique is most appropriate?

Email-to-WHOIS, searching for other domains with the same registrant email

Email-to-IP, searching for the email server's IP address

Email-to-domain, searching for the email domain in passive DNS

Email-to-hash, searching for file hashes associated with the email

An analyst wants to pivot from a known malicious domain to find other domains registered by the same threat actor. Which data source would provide the most direct link?

Malware sandbox reports for the domain

Threat intelligence platform's indicator feed

Passive DNS records for the domain

An analyst is documenting a pivot chain that involved multiple data sources and manual verification. What should the documentation include to ensure the findings can be trusted by other analysts?

The threat actor's likely country of origin

The confidence level assigned to each pivot step and the reasoning behind it

The total number of indicators found

The names of the analysts who performed the investigation

An analyst has completed a pivot investigation that linked a phishing domain to a command-and-control server and then to a malware family. The analyst must document the findings for a threat intelligence report. What is the most important element to include in the documentation?

The names of the tools used in the investigation

The number of indicators found at each pivot stage

The threat actor's likely motivation and objectives

The exact pivot steps, including the data sources and queries used at each stage

GIAC Cyber Threat Intelligence

Domain 5Objective 1

Pivoting GCTI Practice Questions (Page 2)

Part of the Advanced Analysis Techniques domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 7–12 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 6–10

6application · medium
An analyst is documenting a pivot chain for a threat intelligence report. The chain is: malicious file hash -> sandbox report -> C2 domain -> passive DNS -> related IPs. What is the best way to present this chain in the report?
Select an answer first
7application · medium
An analyst has a malicious email address and wants to find other domains associated with the same threat actor. Which pivot technique is most appropriate?
Select an answer first
8application · medium
An analyst wants to pivot from a known malicious domain to find other domains registered by the same threat actor. Which data source would provide the most direct link?
Select an answer first
9application · medium
An analyst is documenting a pivot chain that involved multiple data sources and manual verification. What should the documentation include to ensure the findings can be trusted by other analysts?
Select an answer first
10application · medium
An analyst has completed a pivot investigation that linked a phishing domain to a command-and-control server and then to a malware family. The analyst must document the findings for a threat intelligence report. What is the most important element to include in the documentation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.