Pivoting GCTI Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An analyst is investigating a series of attacks that occurred on the same day across multiple organizations. The analyst has identified a common IP address used in all attacks. To find other attacks from the same actor that occurred on different days, which pivot type is most appropriate?

   • AEntity-based pivoting, pivoting from the IP to the organization
   • BHash-based pivoting, pivoting from the IP to a file hash
   • CTemporal pivoting, pivoting from the attack date to other attacks on the same date
   • DIndicator-based pivoting, pivoting from the IP address to other indicators
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An analyst pivots from a known malicious IP to all domains that have resolved to it in the past year. The pivot returns 50 domains, but only 5 are confirmed malicious. What is the most likely reason for the high number of unrelated domains?

   • AThe passive DNS data is stale and contains outdated records
   • BThe analyst used the wrong pivot type
   • CThe IP address is a shared hosting server that hosts many legitimate domains
   • DThe threat actor registered many domains to hide their activity
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An analyst is documenting a pivot chain for a report. The chain is: email address -> domain -> IP -> malware sample. Which format best supports reproducibility?

   • AA diagram only, without textual explanation.
   • BA table with columns for each step, the indicator, the data source, and the timestamp.
   • CA narrative paragraph describing the investigation.
   • DA list of final indicators without the intermediate steps.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   After performing multiple pivots, an analyst has a list of related indicators. What should the analyst do to prioritize which findings to investigate first?

   • AOnly investigate indicators that are directly linked to the original indicator
   • BInvestigate all indicators equally regardless of source
   • CFocus on indicators with the highest relevance and confidence scores
   • DPrioritize indicators that are easiest to block
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst pivots from a known malicious domain to all IP addresses it has resolved to in the past year. One of the IPs is a shared hosting server that hosts hundreds of unrelated websites. What is the most appropriate way to handle this finding?

   • AReport all domains on the IP as potentially compromised without further analysis.
   • BIgnore the IP entirely because shared hosting makes it useless for pivoting.
   • CTreat all websites on the shared IP as malicious because they share the same IP.
   • DMark the IP as low confidence and look for additional corroborating indicators before associating other domains with the threat.
   Reveal Solution Discussion Select an answer first