An analyst is investigating a targeted attack. The only initial indicator is a malicious document hash. The analyst wants to identify the threat actor's infrastructure. Which pivot sequence would be most effective, considering that the document may have been delivered via multiple methods?

Hash-to-IP, then IP-to-domain, then domain-to-WHOIS

Hash-to-WHOIS, then WHOIS-to-email, then email-to-domains

Hash-to-sample in a sandbox, then extract network indicators from the sample, then pivot on those indicators

Hash-to-passive DNS, then passive DNS-to-domains

An analyst is investigating a campaign that uses fast-flux DNS. The known malicious domain resolves to different IPs every few minutes. The analyst wants to identify the underlying infrastructure. Which pivot approach is most likely to yield useful results?

Email-to-actor pivoting using the domain's WHOIS email.

Temporal pivoting to collect all IPs the domain resolved to over time and then pivot on those IPs.

IP-to-domain pivoting on a single resolved IP.

Hash-to-sample pivoting using the malware hash.

An analyst is pivoting from a known malicious domain to related infrastructure. The domain's WHOIS record shows a registrant email that is also found in 20 other domains. However, the email address is a free webmail address that is commonly used by both malicious and legitimate actors. The analyst also finds that the domain resolves to an IP that is a known Tor exit node. Which pivot result should be treated with the most caution?

The 20 domains sharing the free webmail address.

Both the 20 domains and the Tor exit node IP equally.

Neither, because both are valid pivot results.

An analyst is investigating a phishing campaign that uses a new domain every day. The analyst has a list of known malicious email addresses used in the campaign. Which pivot type would be most effective to identify additional infrastructure?

Indicator-based pivoting using the IP addresses of the known domains.

Hash-based pivoting using the phishing email attachment hashes.

Entity-based pivoting using the email addresses to find other domains registered with the same contact information.

Temporal pivoting to find domains registered around the same time as the known domains.

GIAC Cyber Threat Intelligence

Domain 5Objective 1

Pivoting GCTI Practice Questions (Page 5)

Part of the Advanced Analysis Techniques domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 7–12 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 21–25

21expert · hard
An analyst is investigating a targeted attack. The only initial indicator is a malicious document hash. The analyst wants to identify the threat actor's infrastructure. Which pivot sequence would be most effective, considering that the document may have been delivered via multiple methods?
Select an answer first
22expert · hard
An analyst is investigating a campaign that uses fast-flux DNS. The known malicious domain resolves to different IPs every few minutes. The analyst wants to identify the underlying infrastructure. Which pivot approach is most likely to yield useful results?
Select an answer first
23expert · hard
An analyst is pivoting from a known malicious domain to related infrastructure. The domain's WHOIS record shows a registrant email that is also found in 20 other domains. However, the email address is a free webmail address that is commonly used by both malicious and legitimate actors. The analyst also finds that the domain resolves to an IP that is a known Tor exit node. Which pivot result should be treated with the most caution?
Select an answer first
24application · medium
An analyst is investigating a phishing campaign that uses a new domain every day. The analyst has a list of known malicious email addresses used in the campaign. Which pivot type would be most effective to identify additional infrastructure?
Select an answer first
25foundation · easy
Which pivot technique would an analyst use to find other malware samples that share the same code or family as a known malicious file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Pivoting GCTI Practice Questions (Page 5)

Questions 21–25

An analyst is investigating a targeted attack. The only initial indicator is a malicious document hash. The analyst wants to identify the threat actor's infrastructure. Which pivot sequence would be most effective, considering that the document may have been delivered via multiple methods?

An analyst is investigating a campaign that uses fast-flux DNS. The known malicious domain resolves to different IPs every few minutes. The analyst wants to identify the underlying infrastructure. Which pivot approach is most likely to yield useful results?

An analyst is investigating a phishing campaign that uses a new domain every day. The analyst has a list of known malicious email addresses used in the campaign. Which pivot type would be most effective to identify additional infrastructure?

Which pivot technique would an analyst use to find other malware samples that share the same code or family as a known malicious file?

Keep studying — Advanced Analysis Techniques