When analyzing pivot results, what does identifying a pattern of multiple domains resolving to the same IP over time indicate?

A potential relationship between the domains and the IP, possibly indicating shared infrastructure

That the IP is definitely malicious

That the IP is a sinkhole operated by a security vendor

That the domains are all owned by the same person

An analyst is pivoting from a known malicious IP address to find other domains that have been hosted on it. Which data source is most appropriate for this pivot?

Threat intelligence platform's indicator feed

An analyst has two pivot results from a known malicious domain. Result A: the domain shares a registrant email with 5 other domains, all of which have been sinkholed. Result B: the domain resolves to an IP that also hosts 50 other domains, none of which have any known malicious activity. The analyst must decide which result to investigate first. What should the analyst do?

Investigate both results equally because both are valid pivots.

Investigate Result A because the shared registrant email is a strong entity link and the sinkholed domains confirm maliciousness.

Investigate Result B because the IP is a direct network indicator.

Investigate Result B first because it may reveal new malicious domains.

An analyst has completed a pivot investigation that started from an email address and led to a domain, then to an IP, and finally to a malware sample. The analyst needs to document the findings for a threat intelligence report. What is the most important aspect to include?

The complete pivot chain with each step, the data source, and the rationale for each transition.

Only the final conclusions and recommended actions.

The final malware sample's hash and detection rate.

A list of all tools used during the investigation.

An analyst is reviewing pivot results from a malware sample. The sample communicates with a domain that is registered to a known threat actor. The domain resolves to an IP that is also used by a popular web hosting service. What is the most reasonable conclusion?

The threat actor is the web hosting provider.

The pivot results are useless because of the shared IP.

The domain is likely malicious, but the IP has low confidence due to shared hosting.

The IP is definitely malicious because it is associated with the sample.

GIAC Cyber Threat Intelligence

Domain 5Objective 1

Pivoting GCTI Practice Questions (Page 3)

Part of the Advanced Analysis Techniques domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 7–12 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 11–15

11foundation · easy
When analyzing pivot results, what does identifying a pattern of multiple domains resolving to the same IP over time indicate?
Select an answer first
12application · medium
An analyst is pivoting from a known malicious IP address to find other domains that have been hosted on it. Which data source is most appropriate for this pivot?
Select an answer first
13expert · hard
An analyst has two pivot results from a known malicious domain. Result A: the domain shares a registrant email with 5 other domains, all of which have been sinkholed. Result B: the domain resolves to an IP that also hosts 50 other domains, none of which have any known malicious activity. The analyst must decide which result to investigate first. What should the analyst do?
Select an answer first
14application · medium
An analyst has completed a pivot investigation that started from an email address and led to a domain, then to an IP, and finally to a malware sample. The analyst needs to document the findings for a threat intelligence report. What is the most important aspect to include?
Select an answer first
15application · medium
An analyst is reviewing pivot results from a malware sample. The sample communicates with a domain that is registered to a known threat actor. The domain resolves to an IP that is also used by a popular web hosting service. What is the most reasonable conclusion?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.