An analyst has a malware sample and wants to find other samples from the same threat actor. The analyst decides to pivot using the sample's unique embedded string. What is the primary advantage of this pivot over using the sample's file hash?

The string is easier to search in public sandboxes

The string is more specific and less likely to produce false positives

The string is less likely to be modified by the actor

The string can be used to pivot to the actor's email address

An analyst pivots from a domain to an IP using passive DNS data. Why might the resulting IP be inaccurate?

Passive DNS data only contains IPv6 addresses

Passive DNS data is only available for malicious domains

Passive DNS data is always encrypted

Passive DNS data can be stale and may not reflect current resolutions

Which data source is most commonly used to pivot from a domain name to the IP address it resolves to?

Threat intelligence platform feeds

What should be included in the documentation of a pivot chain to support reproducibility?

The starting indicator, each pivot step, the data sources used, and the resulting findings

The analyst's personal opinions about the threat

Only the final list of indicators

The raw logs from every system involved

An analyst is investigating a series of attacks that occurred every Tuesday for three weeks. Each attack used a different IP address and domain, but the malware samples are identical. Which pivot type would be most effective to link the attacks?

Hash-based pivoting to find other samples with the same hash.

Temporal pivoting to find other attacks that occurred on Tuesdays.

Entity-based pivoting using the domains' registrant information.

Indicator-based pivoting using the malware hash to find other infrastructure associated with the same sample.

GIAC Cyber Threat Intelligence

Domain 5Objective 1

Pivoting GCTI Practice Questions (Page 7)

Part of the Advanced Analysis Techniques domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 7–12 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 31–35

31application · medium
An analyst has a malware sample and wants to find other samples from the same threat actor. The analyst decides to pivot using the sample's unique embedded string. What is the primary advantage of this pivot over using the sample's file hash?
Select an answer first
32foundation · easy
An analyst pivots from a domain to an IP using passive DNS data. Why might the resulting IP be inaccurate?
Select an answer first
33foundation · easy
Which data source is most commonly used to pivot from a domain name to the IP address it resolves to?
Select an answer first
34foundation · easy
What should be included in the documentation of a pivot chain to support reproducibility?
Select an answer first
35application · medium
An analyst is investigating a series of attacks that occurred every Tuesday for three weeks. Each attack used a different IP address and domain, but the malware samples are identical. Which pivot type would be most effective to link the attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.